DP1 TAP query on RSP - DALServiceError: 401 Client Error: Unauthorized for url: https://data.lsst.cloud/api/tap/async

Support Rubin Science Platform
#1

I’m getting an error running a TAP query on the RSP that was working fine last week. I’m trying to figure out if it’s a “just me” thing or not. It seems like an authorization issue, but I’m on the RSP so I’m not sure why I’m not authorized. Maybe some broader credentials expired?

Anyway, here’s the simplest version of the TAP query that generates the error:

from lsst.rsp import get_tap_service
service = get_tap_service("tap")
service.submit_job("SELECT * FROM dp1.DiaSource LIMIT 1")

And here’s the error I’m seeing:

---------------------------------------------------------------------------
HTTPError                                 Traceback (most recent call last)
File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/pyvo/dal/tap.py:708, in AsyncTAPJob._update(self, wait_for_statechange, timeout)
    707         response = self._session.get(self.url, stream=True, timeout=timeout)
--> 708     response.raise_for_status()
    709 except requests.RequestException as ex:

File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/requests/models.py:1026, in Response.raise_for_status(self)
   1025 if http_error_msg:
-> 1026     raise HTTPError(http_error_msg, response=self)

HTTPError: 401 Client Error: Unauthorized for url: https://data.lsst.cloud/api/tap/async

During handling of the above exception, another exception occurred:

DALServiceError                           Traceback (most recent call last)
Cell In[4], line 3
      1 from lsst.rsp import get_tap_service
      2 service = get_tap_service("tap")
----> 3 service.submit_job("SELECT * FROM dp1.DiaSource LIMIT 1")

File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/pyvo/dal/tap.py:373, in TAPService.submit_job(self, query, language, maxrec, uploads, **keywords)
    345 def submit_job(
    346         self, query, *, language="ADQL", maxrec=None, uploads=None,
    347         **keywords):
    348     """
    349     submit a async query without starting it and returns a AsyncTAPJob
    350     object
   (...)    371     AsyncTAPJob
    372     """
--> 373     return AsyncTAPJob.create(
    374         self.baseurl, query, language=language, maxrec=maxrec, uploads=uploads,
    375         session=self._session, **keywords)

File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/pyvo/dal/tap.py:656, in AsyncTAPJob.create(cls, baseurl, query, language, maxrec, uploads, session, **keywords)
    652 tapquery = TAPQuery(
    653     baseurl, query, mode="async", language=language, maxrec=maxrec,
    654     uploads=uploads, session=session, **keywords)
    655 response = tapquery.submit()
--> 656 job = cls(response.url, session=session)
    657 return job

File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/pyvo/dal/tap.py:675, in AsyncTAPJob.__init__(self, url, session, delete)
    673 self._session = use_session(session)
    674 self._delete_on_exit = delete
--> 675 self._update()

File /opt/lsst/software/stack/conda/envs/lsst-scipipe-10.1.0/lib/python3.12/site-packages/pyvo/dal/tap.py:710, in AsyncTAPJob._update(self, wait_for_statechange, timeout)
    708     response.raise_for_status()
    709 except requests.RequestException as ex:
--> 710     raise DALServiceError.from_except(ex, self.url)
    712 # requests doesn't decode the content by default
    713 response.raw.read = partial(response.raw.read, decode_content=True)

DALServiceError: 401 Client Error: Unauthorized for url: https://data.lsst.cloud/api/tap/async
#2

Dear Ben,
Thank you for your question!
I have tried your code snippet in my own Jupyter notebook on the RSP at data.lsst.cloud, and I do not get an error.
Let me investigate this further.
Do you still get this problem if you log out entirely of the RSP and log back in?
Thanks!
Best regards,
Douglas

#3

@bengebre to be clear you are getting this from on a notebook running on data.lsst.cloud? or externally?

#4

That fixed it (totally logging out of the RSP and then logging back in). Not sure why it didn’t work this morning when I first logged into the RSP, but glad to have it working again. Thanks for the help.

PS: @frossie - yes, this was on data.lsst.cloud not local.

#5

This is definitely a bug on our part but it’s hard to figure out what is going on.

If someone down the road is reading this and you have the luxury of waiting for it to be resolved, let us know before you restart/logout/etc so we can do some troubleshooting.

Sorry about that.

#6

Okay I believe we found the bug that caused this to happen [1] and a fix is going out during today’s Patch Thursday.

If you or anybody else runs into this problem (specifically, a 401 Client Error message from a running notebook) please report it as I don’t expect it to re-occur.

  1. For the technically curious; we make sure that when a user spaws a notebook server that their authentication will not expire during the lifetime of that server. However when we made the change to user-specific subdomains for those servers (which is why you now see your_username.nb.data.lsst.cloud in your browser’s URL bar when you’re using our notebook service), there was a gap in logic that stopped this from working correctly. ↩︎

1 Like