IPT can't update registration (wrong config/registration2.xml)

[abubelinha]

Original issue title was: "can't update test mode IPT registration after IP address change"

We have migrated two IPT endpoints (/ipt + /iptest paths) to a different IP address (from 193.144.34.193 to 193.144.42.51)

Both production+test servers are still running in both IPs: the 2nd one is just a clone of the same VM (under a different IP), where we stopped tomcat 9, edited the relevant IP address references inside IPT config files (for both paths), and then restarted tomcat 9.

Then we clicked the UPDATE REGISTRATION button, with different success:

• Production IPT (v. 2.6.1) registration was updated without any problems:
  https://www.gbif.org/installation/86e4d50b-d77c-4731-99fb-b3e2a2a83163
• Test mode IPT (v. 2.6.3) is the one which failed to update its registration:
  https://www.gbif-uat.org/installation/586ccccd-44a5-4c64-a414-43892f84f6f5

We have been getting this error for more than 10 days in the 2nd IP test mode IPT:

A bad request was issued. Please contact the GBIF Helpdesk (helpdesk@gbif.org) for help [https://gbrds.gbif-uat.org/registry/ipt/update/586ccccd-44a5-4c64-a414-43892f84f6f5]

IPT registration update failed! Update IPT registration failed: HTTP/1.1 400 Bad Request

I tried for several days at different hours.
I also restarted tomcat. Logged out and in again with the admin ... But always get 400

Today I finally gave up and decided to update the test mode IPT of the new server.
(old server /iptest was running IPT 2.6.3 and the one in the new VM is now running IPT 3.0.1)
But we still keep getting 400.
Any ideas?

Indeed we plan to update the production IPT, but not before everything goes well in the test one.

Thanks
@abubelinha

[mike-podolskiy90]

Thank you for reporting this

You need to update the tokens in Admin/Registration options/Tokens

[abubelinha]

Thanks @mike-podolskiy90

Why does this only happen to our test mode installation?
I didn't have any problems to update registry for the old production IPT 2.6.1

[mike-podolskiy90]

It happens when the tokens are corrupted. Also, please make sure to use the latest version, which is the 3.1.0

[abubelinha]

Yes, in this test IPT we are using version 3.1.0

OK, I clicked the "update tokens" button and saw this green message:

IPT tokens update succeeded!

But then, I clicked the "update registration" button and I keep seeing the 400 error.

[mike-podolskiy90]

Did you put actual token values in the inputs?

[abubelinha]

No. I don't recall having done this in the past.
Is this something new in IPT 3?

Should I already have those tokens saved somewhere when I installed IPT 2.6.x? (I was expecting those boxes to auto fill when I clicked the update tokens button).

[ManonGros]

@abubelinha you can contact helpdesk@gbif.org, to ask for the tokens again

[abubelinha]

Thanks @ManonGros ... does your "again" mean we should have received those tokens in the past when installing 2.6.x or a previous release?

Then I will look for them before bothering.
But I used to launch a script for upgrading our IPT releases up to 2.6.3 and the tokens were not employed or even commented in any step.

[ManonGros]

If the organisations are registered in your IPT, then you must have had the tokens at some point (likely in an email). Let us know if you would like them (re)sent.

[abubelinha]

Thanks @ManonGros

I have an email like this from registry@gbif.org (dated 2011):

You, or someone else, has requested the password for the organisation 'xxx' to be sent to your e-mail address ([yyy])

The information requested is:

Username: 8chars-4chars-4chars-4chars-12chars
Password: 11chars

Is this what I need?
I guess that email was related to our production IPT, not the test mode IPT.

I don't have any emails received from registry@gbif-uat.org
Should I have one also or do the same credentials apply to both.

Anyway the emailed info and the IPT field names are somehow different:

• Email: username / password
• IPT: Organization's shared token / IPT password

Are we talking about the same things here?
Thanks

[ManonGros]

Hi @abubelinha I think it should be the same thing (we used to call the tokens "password").
You can try it and see if it works. If not, please email us with the name of the organization. Thanks!

[abubelinha]

Thanks but this "update tokens" form is a bit confusing.
The organization token I am using (from that old email) seems to be correct:

• I logged in registry.gbif-uat.org with my gbif user account and was able to find the organization and its "shared token" button. When I click it, I see the same token I received in that email, together with this message "The password is only for use with the IPT (the GBRDS API)".
• If I put that token in the test mode IPT "Organization's shared token" form field, together with ANY string in the "IPT password" field, when I click the "update tokens" button I get a green "IPT tokens update succeeded!" banner ... so it looks like the token was correct (if I change it, I get a red banner).

But what about the IPT password?
I don't understand why the IPT doesn't complain about what I put in that field (as long as it has >=6 chars, I get a green banner as long as the token was correct ... so you may unconsciously submit a wrong IPT password but you see the same message as if it was correct).

And regarding to my original issue ... after "updating the token" I still cannot "update the registry" ... I keep getting either 400 or 401,
depending on the "IPT password" string used above:

• wrong token leads to red banner when updating tokens (so I don't even try to update registry)
• correct token + correct IPT password (green token banner), leads to 400 error when I later try to update registry
• correct token + any wrong IPT password (why green token banner so?!), leads to 401 error when I later try to update registry

---

Side note:
How I noticed about wrong IPT passwords: in my first try I was not sure about what the "IPT password" meant (its input box is next to the organization token input box, so I thought that was referring to the password received in that old email).
So I introduced those ... as I said, the token was correct so the green banners didn't help to know if the IPT password was wrong or not.

As I was getting 401, I guessed the IPT password was probably wrong despite of green banners.
I looked at registration2.xml and found wsPassword section. So I compared its value with the one in the original VM (old IP address) and realized I was being asked the old IPT master password.
I tried that and it must be correct since that's the only string which does not lead me to a 401.

But anyway I keep getting 400 error when trying to update registry later on.
Any hints @mike-podolskiy90 ?

[mike-podolskiy90]

I've never seen it throws 400 with valid tokens. I have to see logs in the Registry to get more ideas, but I also need to know when requests were sent (at least 400 ones) and what env (test or prod)

[abubelinha]

I've never seen it throws 400 with valid tokens. I have to see logs in the Registry to get more ideas, but I also need to know when requests were sent (at least 400 ones) and what env (test or prod)

Thanks @mike-podolskiy90
As I said, this is all in test mode environment.

I reported the tokens and IPT password by email to helpdesk last friday, so I suppose you already have them.
Do you want me to send them to any other email as well?

I'll retry registry update later on and annotate the date and time, so I can send this to you too.