Update pynux ezid code to set a specific User-Agent header, and have EZID whitelist it

[barbarahui]

Pynux can’t authenticate to EZID right now, i.e.:

% curl -v -u cdldsc -p https://ezid-stg.cdlib.org/login      
Enter host password for user ‘cdldsc’:
* Host ezid-stg.cdlib.org:443 was resolved.
* IPv6: (none)
* IPv4: 54.68.56.46, 35.162.220.79, 50.112.186.106
*   Trying 54.68.56.46:443…
* Connected to ezid-stg.cdlib.org (54.68.56.46) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-AES128-GCM-SHA256 / [blank] / UNDEF
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=ezid-stg.cdlib.org
*  start date: Apr 28 00:00:00 2024 GMT
*  expire date: May 27 23:59:59 2025 GMT
*  subjectAltName: host "ezid-stg.cdlib.org" matched cert's "ezid-stg.cdlib.org”
*  issuer: C=US; O=Amazon; CN=Amazon RSA 2048 M02
*  SSL certificate verify ok.
* using HTTP/2
* Server auth using Basic with user ‘cdldsc’
* [HTTP/2] [1] OPENED stream for https://ezid-stg.cdlib.org/login
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: ezid-stg.cdlib.org]
* [HTTP/2] [1] [:path: /login]
* [HTTP/2] [1] [authorization: Basic Y2RsZHNjOldhaTdhaUtv]
* [HTTP/2] [1] [user-agent: curl/8.7.1]
* [HTTP/2] [1] [accept: */*]
> GET /login HTTP/2
> Host: ezid-stg.cdlib.org
> Authorization: Basic Y2RsZHNjOldhaTdhaUtv
> User-Agent: curl/8.7.1
> Accept: */*
> 
* Request completely sent off
< HTTP/2 202 
< server: awselb/2.0
< date: Tue, 25 Mar 2025 23:28:45 GMT
< content-length: 0
< x-amzn-waf-action: challenge
< cache-control: no-store, max-age=0
< content-type: text/html; charset=UTF-8
< access-control-allow-origin: *
< access-control-max-age: 86400
< access-control-allow-methods: OPTIONS,GET,POST
< access-control-allow-headers: x-amzn-waf-action
< 
* Connection #0 to host ezid-stg.cdlib.org left intact

We need to set the User-Agent header and ask EZID to whitelist it.

[barbarahui]

Update: the EZID team updated the code to fix this problem. No User-Agent header is required in the client request. Closing this ticket.