I have some r code and I am having some issues with automatic authentication to access the spreadsheets in a shiny dashboard.
I have set up the servers on a VM and have been able to make r-studio server and shiny-server work. Problem now lies within app deployment. Currently I have been able to do this in a user session. But the problem is not that I am getting redirected to google authentication and it is not allowing me to do that on the server side so the execution halts.
This is shared with all googleAnalyticsR users.
If making a lot of API calls, please:
visit: XXXXXXXXXXXXX
for instructions on setting your own Google Project
2019-05-05 02:55:52> Set API cache
2019-05-05 02:55:52> No environment argument found, looked in
GA_AUTH_FILE
2019-05-05 02:55:52> No httr_oauth_cache file found at sc.httr-
oauth - creating new file.
Error in value[[3L]](cond) :
Authentication options didn't match existing session token and
not interactive session
so unable to manually reauthenticate
Calls: local ... tryCatch -> tryCatchList -> tryCatchOne ->
<Anonymous>
Execution halted
The expected results would not showcase an Execution Halted.
Furthermore on the server itself it is not really allowing me to actually allow for such extensions. So I am curious if someone had any suggestions. I can also offer the code if needed for the actual app.R.
You need to upload the sc.httr-oauth (or whatever you have called it) authentication token that is generated locally to the script's working directory on the server, so the authentication can find it. You should also make sure the permissions for the file lets Shiny update it.
You are seeing an error where its looking for the file but it not being present, it then attempts to re-authenticate by launching a browser but as its not a interactive R session it will fail (you can't log in for the OAuth2 flow)
You can specify the authentication token location in your script via ga_auth("file_location")
Related
I'm using Python to interact with Google Sheet API using a library called gspread_pandas.
The flow to let this python script to authenticate on google is basically:
Create a project on GCP;
Create an OAuth2 token (the application type is "web app" , but in doubt if should be
"desktop app");
Expose the token on local environment and run the python script;
The Python Script will ask to access a link like below:
https://accounts.google.com/o/oauth2/auth?response_type=code&client_id=foo.apps.googleusercontent.com&redirect_uri=http%3A%2F%2Flocalhost%3A8182%2F&scope=openid+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fdrive+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fspreadsheets&state=acbdef&access_type=offline
And if I succeed on login, it runs the script smoothly (the data from sheets are retrieved by the python script).
Link to the description of authentication process.
It runs fine if I'm running it locally on my machine, when I setup this workflow on EC2,
when I run the python script on the EC2 terminal, it asks me to access an external link (accounts.google...) and when I click on it, I open the browser on my local machine, I insert my google credentials and at the end of the process it throws:
This site can’t be reachedlocalhost refused to connect.
Try:
Checking the connection
Checking the proxy and the firewall
ERR_CONNECTION_REFUSED
The terminal on EC2 keeps stuck waiting for the login process to end but it already failed on my local browser (on my machine).
My suspicion is that when I log on google using my local browser, it can't get back to the EC2 and finish the authentication process.
The type of this OAuth token is "Web Application" and the URI redirect I set https://<public-ip>.sslip.io/8182 (so I can use the aws public ip on gcp, for testing only).
I wonder how to use Google OAuth on a remove server and login to google account on my local browser. I'm trying this method because the library docs says its possible:
you will have to authenticate through a text based OAuth prompt; this makes it possible to run on a headless server through ssh or through a Jupyter notebook
Link to citation
I tried to use service-account but my company does not allow this kind of auth.
I created my azure web-app and created app registration. and connected Azure AD to my web app. I used express security and I also used advance security with client ID and client secret. I know there is a similar question about this error. but it is not clear answer.
Most likely causes:
IIS received the request; however, an internal error occurred during the processing of the request. The root cause of this error depends on which module handles the request and what was happening in the worker process when this error occurred.
IIS was not able to access the web.config file for the Web site or application. This can occur if the NTFS permissions are set incorrectly.
IIS was not able to process configuration for the Web site or application.
The authenticated user does not have permission to use this DLL.
The request is mapped to a managed handler but the .NET Extensibility Feature is not installed.
Things you can try:
Ensure that the NTFS permissions for the web.config file are correct and allow access to the Web server's machine account.
Check the event logs to see if any additional information was logged.
Verify the permissions for the DLL.
Install the .NET Extensibility feature if the request is mapped to a managed handler.
Create a tracing rule to track failed requests for this HTTP status code. For more information about creating a tracing rule for failed requests, click here.
From your description, I know that the problem is most likely due to the lack of web.config file.
Solution:
It is recommended to ensure that your project can run normally locally.
Continuous deployment is recommended
At present, the reason for your problem is the lack of web.config, which will be automatically created when using git deployment. As shown below.
For more details, you can check my answer in another post.
Azure Web App getting “You do not have permission to view this directory or page.” when launch app
I have a web app in Google App Engine (with Flask) that needs to ask the user for permissions.
I followed this explanation and it got me working great.
But how do I get the secret_file (or client_config) credentials?
All examples I saw used a local file - but that is not production safe! Is there any way to get it from the application credentials?
I also tried using oauth2client.client.GoogleCredentials.get_application_default() but that seems to be a service account which I can't use.
Creation of web app authorization credentials is discussed here.
Once you are done with the form, client_secret.json file will be generated and is downloadable via the API Console.
There will be a 'Download JSON' button at the right of the OAuth Client credential you created and at the upper part of the page when you click on the Client ID.
From this documentation, it is explained how to construct the authorization request using google-auth-oauthlib.flow module.
In Python, call the from_client_secrets_file method to retrieve the
client ID from a client_secret.json file. (You can also use the
from_client_config method, which passes the client configuration as it
originally appeared in a client secrets file but doesn't access the
file itself.)
I'm trying to use bigrquery from an interactive R session for the first time. I've installed the R bigrquery package and successfully established a connection. I've authenticated following a redirect from the interactive RStudio session to the web browser for login, so oauth seems to be working correctly. However, when I try to run a query, such as DBI::dbReadTable(con, "A549_raw_merged_TADs")[1:6, ], I get the error Error: The project variant-annotation has not enabled BigQuery. [invalid].
I am sure I need to enable something else in the project on the Google side, but I'm not sure what I need to enable, or how to do that from the web console interface.
Is this documented anywhere, or can anyone here give me instructions?
Note: I have confirmed that the BigQuery API has Activation status of Enabled via the console at https://console.cloud.google.com/apis/api/bigquery-json.googleapis.com/overview, so although my question is the same as Error processing job: Project has not enabled BigQuery, the issue appears to be different.
Additional information: when I check the BigQuery API status via the console link above, there's a notification that "To use this API, you may need credentials. Click 'Create credentials' to get started."
So it may be that my assumption that oauth seems to be working is not correct.
You can enable the BigQuery API with this command gcloud services enable bigquery.googleapis.com, but, since you mention it is already enabled, you may be pointing to a different project.
Feel free to ping me on a new thread if you require assistance on the new issue.
We're having a hard time figuring how these credentials objects work. In fact, they may not work how we expected them to work. Here's an explanation of the current issue.
We got 2 servers that needs to talk with each other through webservices. The first one (let's call it Server01) has a Windows Service running as the NetworkService account. The other one Server02 has ReportingServices running with IIS 6.0. The Windows Service on Server01 is trying to use the Server02 ReportingServices WebService to generate reports and send them by email.
So, here's what we tried so far.
Setting the credentials at runtime (This works perfectly fine):
rs.Credentials = new NetworkCredentials("user", "pass", "domain");
Now, if we could use a generic user all would be fine, however... we are not allowed to. So, we are trying to use the DefaultCredetials or DefaultNetworkCredentials and pass it to the RS Webservice:
rs.Credentials = System.Net.CredentialCache.DefaultNetworkCredentials
Or:
rs.Credentials = System.Net.CredentialCache.DefaultCredentials
Either way won't work. We're always getting 401 Unauthrorized from IIS. Now, what we know is that if we want to give access to a resource logged as NetworkService, we need to grant it to DOMAIN\MachineName$ (http://msdn.microsoft.com/en-us/library/ms998320.aspx):
Granting Access to a Remote SQL Server
If you are accessing a database on another server in the same domain (or in a trusted domain), the Network Service account's network credentials are used to authenticate to the database. The Network Service account's credentials are of the form DomainName\AspNetServer$, where DomainName is the domain of the ASP.NET server and AspNetServer is your Web server name.
For example, if your ASP.NET application runs on a server named SVR1 in the domain CONTOSO, the SQL Server sees a database access request from CONTOSO\SVR1$.
We assumed that granting access the same way with IIS would work. However, it does not. Or at least, something is not set properly for it to authenticate correctly.
So, here are some questions:
We've read about "Impersonating Users" somewhere, do we need to set this somewhere in the Windows Service ?
Is it possible to grant access to the NetworkService built-in account to a remote IIS server ?
Thanks for reading!
All details you need are included in this very old article
In short, when you find it confusing to troubleshoot issues like this, you should first review the technical details behind ASP.NET impersonation carefully.
Here are some things you could check out:
- set an SPN (Service Principal Name) for the reporting service; you can find good examples in google;
- Allow delegation (ClientCredentials.Windows.AllowImpersonationLevel)
Is the problem that you're failing to authenticate to IIS, or failing to authenticate to SSRS? The DOMAIN\MachineName$ account may need to be granted permission in SSRS to run the report you're trying to automate.
SSRS usually does a pretty good job of getting IIS configured correctly, so you shouldn't need to mess with those settings. I double-checked my installation (which is SSRS 2005, things may have worked differently in SSRS 2000 and you didn't say which version you're running), and it's set to use Windows authentication and has impersonation enabled. That means IIS should basically just be authenticating your credentials (validating a correct username/password), not authorizing (determining whether that user has permission to run the report in question). IIS then passes the credentials on to SSRS, which has its own settings for determining what accounts have permission to view reports.
Also, you can automate sending reports on a scheduled basis directly in SSRS, so you may not need the Windows service at all if your scheduling is fairly basic (i.e., daily, weekly, etc.).