basedb-devel — BASE developers mailing list

Re: [basedb-devel] Setting active project via API

[Woodbridge, M. R <m.w...@im...>]

Thanks Nicklas.

I know this issue has come up on the mailing list a couple of times, but I'm not sure what the solution is. As I said, I'm linking directly to Experiments in BASE from my Flex application. I'm doing this by doing an HTTP POST to /login.jsp with a redirect to views/experiments/index.jsp?cmd=ViewItem&item_id=...&ID=...

This works fine but there are a couple of problems. The first is that I call /login.jsp every time I link to an experiment. I'm using the same ID every time to avoid creating a new session. Is this the correct thing to do?

The second problem is this issue with the active project. What is the correct way to ensure that the link works i.e. avoiding linking to an Experiment that isn't shared with the 'active' project? I have tried the following:

1. Generate a session ID
2. Use the webservices API to set the active project for this sessionID
3. Post to /login.jsp using this sessionID

But this doesn't seem to work. Is there a way to link directly to an Experiment, ignoring whatever Project is currently active? Any help would be gratefully received.

Mark.


-----Original Message-----
From: bas...@li... [mailto:bas...@li...] On Behalf Of Nicklas Nordborg
Sent: 07 January 2010 07:31
To: BASE dev
Subject: Re: [basedb-devel] Setting active project via API

Woodbridge, Mark R wrote:
> Hi,
> 
>  
> 
> I'm linking to experiments in BASE from another web application. This 
> works fine, including automatically logging in, as long as the 
> experiment belongs to the user's active project. I'd like to ensure that 
> the correct project is activated before the user clicks on the link. 
> Does anyone know if I can get the relevant project id from an experiment 
> id? There doesn't seem to be an ExperimentInfo.getProject() method.

There is no such method since an experiment can belong to more than one 
project. The web service API has very limited functionality. The 
functionality that currently exists was implemented to support some 
specific use cases (mainly related to downloading data files) for a 
project that we participated in.

Using the regular BASE API you can find the projects by putting the 
experiment in a collection and then using a multi-permissions object:

Collection<Experiment> experiments = ...
MultiPermissions mp = new MultiPermissions(experiments);
ItemQuery<Project> q = mp.getProjects();
List<Project> project = q.list(dc);

The code is a bit awkward, but for some reason the obvious approach, 
Experiment.getProjectKey().getProjects(), is missing.

/Nicklas

------------------------------------------------------------------------------
This SF.Net email is sponsored by the Verizon Developer Community
Take advantage of Verizon's best-in-class app development support
A streamlined, 14 day to market process makes app distribution fast and easy
Join now and get one step closer to millions of Verizon customers
http://p.sf.net/sfu/verizon-dev2dev 
_______________________________________________
basedb-devel mailing list
bas...@li...
https://lists.sourceforge.net/lists/listinfo/basedb-devel

Re: [basedb-devel] Setting active project via API

[Nicklas N. <ni...@th...>]

Woodbridge, Mark R wrote:
> Hi,
> 
>  
> 
> I’m linking to experiments in BASE from another web application. This 
> works fine, including automatically logging in, as long as the 
> experiment belongs to the user’s active project. I’d like to ensure that 
> the correct project is activated before the user clicks on the link. 
> Does anyone know if I can get the relevant project id from an experiment 
> id? There doesn’t seem to be an ExperimentInfo.getProject() method.

There is no such method since an experiment can belong to more than one 
project. The web service API has very limited functionality. The 
functionality that currently exists was implemented to support some 
specific use cases (mainly related to downloading data files) for a 
project that we participated in.

Using the regular BASE API you can find the projects by putting the 
experiment in a collection and then using a multi-permissions object:

Collection<Experiment> experiments = ...
MultiPermissions mp = new MultiPermissions(experiments);
ItemQuery<Project> q = mp.getProjects();
List<Project> project = q.list(dc);

The code is a bit awkward, but for some reason the obvious approach, 
Experiment.getProjectKey().getProjects(), is missing.

/Nicklas

[basedb-devel] Setting active project via API

[Woodbridge, M. R <m.w...@im...>]

Hi,

I'm linking to experiments in BASE from another web application. This works fine, including automatically logging in, as long as the experiment belongs to the user's active project. I'd like to ensure that the correct project is activated before the user clicks on the link. Does anyone know if I can get the relevant project id from an experiment id? There doesn't seem to be an ExperimentInfo.getProject() method.

Many thanks,

Mark.

--
Mark Woodbridge
CISBIC Data Management
Imperial College London

Re: [basedb-devel] Prompting for credentials

[Zak Mc K. <zak...@ya...>]

Nicklas Nordborg wrote:
>>  From previous messages, it seems that the session id is tied to the 
>> client that creates the session (via IP). So it would be linked to the 
>> server running the web service in our case. This is problematic, because 
>> the final link to the BASE experiment will be used by a remote user, 
>> which will be served by a session ID having the wrong IP.
> 
> No this is not the case. If your application is creating the
> SessionControl it can give it any session id that you want or let BASE
> generate an ID, and it can choose which IP to link it with. See the API
> javadoc at this long URL:
> http://base.thep.lu.se/chrome/site/latest/api/net/sf/basedb/core/Application.html#newSessionControl(java.lang.String,%20java.lang.String,%20java.lang.String)
> 

WOW! That sounds like what we were looking for, thank you very much!

Marco.

Re: [basedb-devel] Prompting for credentials

[Nicklas N. <ni...@th...>]

On 2009-12-17 15:27, Zak Mc Kracken wrote:
> Thank you Nicklas, that's clearer now.
> 
> Just more few notes.
> 
> Nicklas Nordborg wrote:
>>
>> 1. Your web service application does this on its own and keeps track of
>> used/active ones so that duplicates are not generated. When the user
>> clicks a link he/she is asked to login to BASE.
>>
> 
> This seems to be the simpler option. A bit less practical, but could be 
> an alternative.
> 
>> 2. Your web service application uses BASE to create a new SessionControl
>> and login using the "guest" account. Use the id from the session control
>> in the link and the user doesn't have to login when it is clicked. Note
>> that your web service application needs to set the proper remote id on
>> the session control, otherwise the "Invalid remote id" message will popup.
>>
> 
>  From previous messages, it seems that the session id is tied to the 
> client that creates the session (via IP). So it would be linked to the 
> server running the web service in our case. This is problematic, because 
> the final link to the BASE experiment will be used by a remote user, 
> which will be served by a session ID having the wrong IP.

No this is not the case. If your application is creating the
SessionControl it can give it any session id that you want or let BASE
generate an ID, and it can choose which IP to link it with. See the API
javadoc at this long URL:
http://base.thep.lu.se/chrome/site/latest/api/net/sf/basedb/core/Application.html#newSessionControl(java.lang.String,%20java.lang.String,%20java.lang.String)


> Is there a way to sort this out? Any plan to change the BASE code on 
> this point? For instance, if one could pass login/password/IP to the 
> authentication web service, or even disable this session/IP feature.

No, this is not going to change. It is very important to not mess with
this since it will make lots of things to not work anymore.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

> From previous messages, it seems that the session id is
> tied to the client that creates the session (via IP). So 
> it would be linked to the server running the web service 
> in our case. This is problematic, because the link to the 
> BASE experiment will be used by a remote user, which will
> be served by a session ID having the wrong IP.

True, I had not thought of that. That would indeed make it 
problematic to log in users from within DC-THERA.

> Any plan to change the BASE code on this point? 

Modifying the authentication logic ourselves is an option.
Nicklas, could you give us a short description of the classes
involved? Just in case.

Regards,

-- O.L.

Re: [basedb-devel] Prompting for credentials

[Zak Mc K. <zak...@ya...>]

Thank you Nicklas, that's clearer now.

Just more few notes.

Nicklas Nordborg wrote:
> 
> 1. Your web service application does this on its own and keeps track of
> used/active ones so that duplicates are not generated. When the user
> clicks a link he/she is asked to login to BASE.
>

This seems to be the simpler option. A bit less practical, but could be 
an alternative.

> 2. Your web service application uses BASE to create a new SessionControl
> and login using the "guest" account. Use the id from the session control
> in the link and the user doesn't have to login when it is clicked. Note
> that your web service application needs to set the proper remote id on
> the session control, otherwise the "Invalid remote id" message will popup.
> 

 From previous messages, it seems that the session id is tied to the 
client that creates the session (via IP). So it would be linked to the 
server running the web service in our case. This is problematic, because 
the final link to the BASE experiment will be used by a remote user, 
which will be served by a session ID having the wrong IP.

Is there a way to sort this out? Any plan to change the BASE code on 
this point? For instance, if one could pass login/password/IP to the 
authentication web service, or even disable this session/IP feature.

Thanks again.

Marco.

Re: [basedb-devel] Prompting for credentials

[Nicklas N. <ni...@th...>]

Zak Mc Kracken wrote:
> Hi Nicklas,
> 
> in reply to your message below. I am working with Olivier on the issue. 
> To me it seems we're stuck on it, I still cannot understand if/how it's 
> possible to do this:
> 
> - A search web service we have written is invoked with certain parameters
> - The ws searches inside BASE and returns a list of URLs. Every URL is 
> about an experiment that matches the search parameters/criteria 
> (actually experiment titles are returned too). Every URL is supposed to 
> automatically open an experiment page in the BASE web interface. We also 
> would like that the URL makes BASE to automatically login a "guest" user 
> (experiments we decide to make publicly visible will be made accessible 
> to this user), with just the initial click of the real end user on the URL.
> 
>  From previous messages in this mailing list, I understand that BASE 
> doesn't allow to keep open multiple user sessions from multiple IPs, so 
> this could be a problem re. what I've described. Or did I get it wrong?

BASE is a multi-user enironment and it is possible to have multiple
users logged on at the same time. The users may be on different ip
addresses or on the same address. In fact, a single person may have
multiple browser windows open, each logged in to a different BASE
account or even to the same account. What matters is that each browser
window has it's own unique session id.

The session id is more or less a replacement for session cookies that a
lot of other web sites uses. The first prototype of BASE 2 actually used
a session cookie, but we made a policy decision to not use cookies and
that is why the session id is sent as part of the URL. The added benefit
of this is that a single user may have multiple browser windows open
each with their own session id. But just as session cookies can't be
shared between users neither can the session id be shared.


> An alternative for us could be that the end user has its own BASE 
> account, he/she provide us with it and we pass it to the web service (or 
> report it in the experiment's URL).
> 
> You may already have guessed that the web service will be invoked by 
> another web application:
> 
> http://ftp.informatik.rwth-aachen.de/Publications/CEUR-WS/Vol-435/poster06.pdf
> 
> and that the returned URLs will be put in this application.
> 
> Is there a way to do what I described above? It's strange we cannot find 
> an answer to that.

No it is not strange because BASE was never intended to be used in that
way. If you want to do something like what you describe you need to
manage the session id's in your web service application. For each new
user that performs a search a new session id is needed. As I see it
there are two possible ways to create new session ids:

1. Your web service application does this on its own and keeps track of
used/active ones so that duplicates are not generated. When the user
clicks a link he/she is asked to login to BASE.

2. Your web service application uses BASE to create a new SessionControl
and login using the "guest" account. Use the id from the session control
in the link and the user doesn't have to login when it is clicked. Note
that your web service application needs to set the proper remote id on
the session control, otherwise the "Invalid remote id" message will popup.

Hope this helps.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Zak Mc K. <zak...@ya...>]

Hi Nicklas,

in reply to your message below. I am working with Olivier on the issue. 
To me it seems we're stuck on it, I still cannot understand if/how it's 
possible to do this:

- A search web service we have written is invoked with certain parameters
- The ws searches inside BASE and returns a list of URLs. Every URL is 
about an experiment that matches the search parameters/criteria 
(actually experiment titles are returned too). Every URL is supposed to 
automatically open an experiment page in the BASE web interface. We also 
would like that the URL makes BASE to automatically login a "guest" user 
(experiments we decide to make publicly visible will be made accessible 
to this user), with just the initial click of the real end user on the URL.

 From previous messages in this mailing list, I understand that BASE 
doesn't allow to keep open multiple user sessions from multiple IPs, so 
this could be a problem re. what I've described. Or did I get it wrong? 
An alternative for us could be that the end user has its own BASE 
account, he/she provide us with it and we pass it to the web service (or 
report it in the experiment's URL).

You may already have guessed that the web service will be invoked by 
another web application:

http://ftp.informatik.rwth-aachen.de/Publications/CEUR-WS/Vol-435/poster06.pdf

and that the returned URLs will be put in this application.

Is there a way to do what I described above? It's strange we cannot find 
an answer to that.

Many thanks in advance for any help.


Marco.


From: Nicklas Nordborg <nicklas@th...> - 2009-12-15 21:45
Olivier Lefevre wrote:
 > Out of curiosity, this error message implies that session IDs,
 > once allocated, are tied to the remote ID the initial request
 > came from. Is it a security feature?

Yes, but a very simple one. The idea is to protect the server from
someone guessing an ID that is in use.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Zak Mc K. <zak...@ya...>]

Olivier Lefevre wrote:
> Hi Marco,
> 
> Not to step on Nicklas' toes but a couple of observations from
> my point of view:
> 
>> From previous messages in this mailing list, I understand
>> that BASE doesn't allow one to keep open multiple user 
>> sessions, coming from multiple IPs
> 
> AFAIK BASE just doesn't allow the *same* session ID to be used by
> multiple IPs; your wording suggests it can and will serve only 
> one user per IP, which would clearly make it useless.
> 

Ops, sorry. Clearly I meant multiple sessions from the same user and 
from multiple IPs. The scenario I am thinking of is multiple real users 
accessing BASE with the same account. But if different sessions can be 
generated for different IPs and using the same account, that would be 
good for us.

Cheers.

Marco.

Re: [basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

Hi Marco,

Not to step on Nicklas' toes but a couple of observations from
my point of view:

> From previous messages in this mailing list, I understand
> that BASE doesn't allow one to keep open multiple user 
> sessions, coming from multiple IPs

AFAIK BASE just doesn't allow the *same* session ID to be used by
multiple IPs; your wording suggests it can and will serve only 
one user per IP, which would clearly make it useless.

As to whether this is a problem or not in practice, remember that
you and I were hitting a BASE instance directly, from separate IPs,
when we ran into this issue, using a bogus ID to boot, hence the 
collision. In the actual usage scenario, in which users send 
requests to BASE not directly but through DC-THERA, I imagine 
that from the BASE server point of view they will appear to 
originate from the same DC-THERA server IP, regardless of user 
IP, hence the issue will be moot.

-- O.L.

Re: [basedb-devel] Prompting for credentials

[Zak Mc K. <zak...@ya...>]

Hi Nicklas,

in reply to your message below, I am working with Olivier on the issue.
I still haven't clear if/how it's possible to do this:

- A search web service we have written is invoked with certain parameters
- The ws searches inside BASE and returns a list of URLs. Every URL is
about an experiment that matches the search parameters/criteria
(actually experiment titles are returned too). Every URL is supposed to
automatically open an experiment page in the BASE web interface. We also
would like that the URL makes BASE to automatically login a "guest" user
(experiments we decide to make publicly visible will be made accessible
to this user), of course when the URL is clicked.

You may already have guessed that the web service will be invoked by
another web application:

http://ftp.informatik.rwth-aachen.de/Publications/CEUR-WS/Vol-435/poster06.pdf

and that the returned URLs will be put in this application.

 From previous messages in this mailing list, I understand that BASE
doesn't allow one to keep open multiple user sessions, coming from 
multiple IPs, so this could be a problem re. what I've described. Or did 
I get it wrong? An alternative for us could be that the end user has its 
own BASE account, he/she provide us with it and we pass it to the web 
service (or report it in the experiment's URL).

Is there a way to do what I described above? It's strange we cannot find
an answer to that.

Many thanks in advance for any help.


Marco.


From: Nicklas Nordborg <nicklas@th...> - 2009-12-15 21:45
Olivier Lefevre wrote:
> Out of curiosity, this error message implies that session IDs,
> once allocated, are tied to the remote ID the initial request
> came from. Is it a security feature?

Yes, but a very simple one. The idea is to protect the server from
someone guessing an ID that is in use.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Nicklas N. <ni...@th...>]

Olivier Lefevre wrote:
> Out of curiosity, this error message implies that session IDs,
> once allocated, are tied to the remote ID the initial request
> came from. Is it a security feature?

Yes, but a very simple one. The idea is to protect the server from 
someone guessing an ID that is in use.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

Out of curiosity, this error message implies that session IDs,
once allocated, are tied to the remote ID the initial request
came from. Is it a security feature?

-- O.L.

Re: [basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

> The stack trace is because trying to use the same session ID 
> that is already used by a different user session.

Thanks, that's clear now: this could indeed happen when a bogus
and constant session ID is used for all requests.

-- O.L.

Re: [basedb-devel] Prompting for credentials

[Nicklas N. <ni...@th...>]

Olivier Lefevre wrote:
> Hi Nicklas, 
> 
>> If you supply a URL like the one above BASE is going to ask 
>> you for a login and password. 
> 
> I assume you mean a screen like the attached. If so that is 
> indeed what I get in my own local development instance but the
> production instance (not managed by me) occasionally returns
> a page with a PermissionDeniedException stack trace instead 
> (screenshot also attached) and at other times the expected 
> login screen, which is a bit confusing. I have never seen the 
> stack trace behavious locally.

The login screen is the prompt I am talking about. The stack trace is
because trying to use the same session ID that is already used by a
different user session.

/Nicklas

Re: [basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

Hi Nicklas, 

> If you supply a URL like the one above BASE is going to ask 
> you for a login and password. 

I assume you mean a screen like the attached. If so that is 
indeed what I get in my own local development instance but the
production instance (not managed by me) occasionally returns
a page with a PermissionDeniedException stack trace instead 
(screenshot also attached) and at other times the expected 
login screen, which is a bit confusing. I have never seen the 
stack trace behavious locally.

Regards,

-- O.L.

Re: [basedb-devel] Prompting for credentials

[Nicklas N. <ni...@th...>]

Olivier Lefevre wrote:
> Is there a way to make BASE2 automatically prompt for
> credentials when a user who is not yet logged in clicks
> on a link pointing to a restricted-access resource? For
> instance the generic URL for an Experiment is 
> http://localhost:8080/base2/views/experiments/index.jsp?ID=uid&cmd=ViewItem&item_id=29
> where uid is some hash. It seems one can use ID=0 as a
> "magic" value once the user is logged in but it fails
> the first time. 
> 
> What is the best way to handle this problem in the 
> context of BASE2? 

I am not exactly sure what you are looking for... If you supply a URL 
like the one above BASE is going to ask you for a login and password. 
The value for ID (eg. 'uid' in the example) can be anything. There is 
nothing magic with ID=0, but the ID has to be a unique string per user 
session, so you can't just put a static link to the page within BASE.

/Nicklas

[basedb-devel] Prompting for credentials

[Olivier L. <lef...@ya...>]

Is there a way to make BASE2 automatically prompt for
credentials when a user who is not yet logged in clicks
on a link pointing to a restricted-access resource? For
instance the generic URL for an Experiment is 
http://localhost:8080/base2/views/experiments/index.jsp?ID=uid&cmd=ViewItem&item_id=29
where uid is some hash. It seems one can use ID=0 as a
"magic" value once the user is logged in but it fails
the first time. 

What is the best way to handle this problem in the 
context of BASE2? 

Thanks,

-- O.L.

Re: [basedb-devel] ServicesUtil problem

[Nicklas N. <ni...@th...>]

Woodbridge, Mark R wrote:
> Hi,
> 
>  
> 
> I might be misunderstanding the documentation but it appears that the 
> Boolean flags that can be passed to the net.sf.basedb.info.QueryOptions 
> constructor are ignored by net.sf.basedb.ws.server.ServicesUtil, as 
> demonstrated by the failure of the following test:

Thanks for reporting this. It seems like the query is already populated 
with some options (eg. Include.MINE is on by default). The 
ServicesUtil.getConfiguredItemQuery() is adding options that has been 
set to true, but is not removing options that has been set to false.

We'll try to fix it in BASE 2.14.2: http://base.thep.lu.se/ticket/1445

/Nicklas

[basedb-devel] BASE 2.14.1 has been released

[Nicklas N. <ni...@th...>]

Hello all,

We are happy to announce the release of BASE 2.14.1. This is a bugfix release
that fixes some critical issues in the new annotation caching system as well
as some other minor issues.

For a complete list of changes, see:
http://base.thep.lu.se/query?status=closed&milestone=BASE+2.14.1&group=type

Installation/upgrade instructions:
http://base.thep.lu.se/chrome/site/latest/html/admindoc/installation_upgrade/installation_upgrade.html

As usual, the program can be downloaded from:
http://base.thep.lu.se/wiki/DownloadPage

/Nicklas

[basedb-devel] BASE 2.14 has been released

[Nicklas N. <ni...@th...>]

Hello all,

We are happy to announce the release of BASE 2.14. This is a major release
that among other things includes:

 * Performance enhancements related to annotation/experimental
   factor handling.
 * New plot functionality and more in experiment explorer.

For a complete list of changes, see:
http://base.thep.lu.se/query?status=closed&milestone=BASE+2.14&group=type

Installation/upgrade instructions:
http://base.thep.lu.se/chrome/site/latest/html/admindoc/installation_upgrade/installation_upgrade.html

As usual, the program can be downloaded from:
http://base.thep.lu.se/wiki/DownloadPage

/Nicklas

[basedb-devel] BASE 2.13.1 has been released

[Nicklas N. <ni...@th...>]

Hello all,

We are happy to announce the release of BASE 2.13.1. This is a bugfix
release that fixes a few annoying but non-critical bugs.

For a complete list of changes, see:
http://base.thep.lu.se/query?status=closed&milestone=BASE+2.13.1

Installation/upgrade instructions:
http://base.thep.lu.se/chrome/site/latest/html/admindoc/installation_upgrade/installation_upgrade.html

As usual, the program can be downloaded from:
http://base.thep.lu.se/wiki/DownloadPage

/Nicklas

[basedb-devel] BASE 2 published in BMC Bioinformatics

[Jari H. <ja...@th...>]

Hi all,

We have published a short presentation of BASE in BMC Bioinformatics 
2009, 10:330 (http://www.biomedcentral.com/1471-2105/10/330).

The article gives an brief overview of BASE and its most important 
features. The paper gives a taste of what can be accomplished with BASE 
today. Now we need that ever important tutorial material  ;-)


Cheers,

Jari

[basedb-devel] BASE 2.13 has been released

[Nicklas N. <ni...@th...>]

Hello all,

We are happy to announce the release of BASE 2.13. The release fixes
several bugs and adds some new features as well.

For a complete list of changes, see:
http://base.thep.lu.se/query?status=closed&milestone=BASE+2.13

Installation/upgrade instructions:
http://base.thep.lu.se/chrome/site/latest/html/admindoc/installation_upgrade/installation_upgrade.html

As usual, the program can be downloaded from:
http://base.thep.lu.se/wiki/DownloadPage

/Nicklas