Datagate lock collection problem

[ariel-lenis]

Hi,
Im testing an android application with datagate, currently my server is exposing the datagate ports in the Dockerfile:

ENV DATAGATE_HTTP_PORT "8080"
ENV DATAGATE_HTTPS_PORT "8443"
ENV DATAGATE_MONITOR_PORT "9090"
ENV DATAGATE_KEY_STORE "keystore.jks"
ENV DATAGATE_KEY_PASSWORD "s3cret"

And this is an example of my test:

        NitriteCollection booksCollection =  db.getCollection("Books");

        if (booksCollection.find(eq("name", "Lost Symbol")).firstOrDefault() == null) {
            Document newBook = new Document();
            newBook.put("name", "Lost Symbol");
            newBook.put("author", "Dan Brown");
            booksCollection.insert(newBook);
        }

        DataGateClient dataGateClient = new DataGateClient("http://myserver:8080")
                .withAuth("admin", "somePassword");

        DataGateSyncTemplate syncTemplate = new DataGateSyncTemplate(dataGateClient, "Books@admin");

        // create sync handle
        SyncHandle syncHandle = Replicator.of(db)
                .forLocal(booksCollection)
                // a DataGate sync template implementation
                .withSyncTemplate(syncTemplate)
                // replication attempt delay of 1 sec
                .delay(timeSpan(10, TimeUnit.SECONDS))
                // both-way replication
                .ofType(ReplicationType.PUSH)
                // sync event listener
                .withListener(new SyncEventListener() {
                    @Override
                    public void onSyncEvent(SyncEventData eventInfo) {
                        Log.i("datagate", "Collection: " + eventInfo.getCollectionName() + " ErrorMessage: " + eventInfo.getError().getMessage() + " EventType: " + eventInfo.getEventType().toString());
                    }
                })
                .configure();

        // start sync in the background using handle
        syncHandle.startSync();

But after run the application i have this message logged:

I/datagate: Collection: Books ErrorMessage: NO2.11012: error while acquiring lock to remote collection EventType: REPLICATION_ERROR

I'm not sure if i'm using the right port (using 9090 give no response)
Also i will like to understand the relation between:

ENV DATAGATE_KEY_STORE "keystore.jks"
ENV DATAGATE_KEY_PASSWORD "s3cret"

I generated the keystore.jks field with the default configuration.

Thanks for your help!

[anidotnet]

You are connecting to the right port. Can you please add below dependency in your project (if not done already) and provide me more detailed log?

compile group: 'org.slf4j', name: 'slf4j-android', version: '1.7.25'

You can consult this test setup while creating your project - SyncIntegrationTest.java

The KEY_STORE and KEY_PASSWORD variables are for configuring ssl for https connections.

[ariel-lenis]

Hi, i added that package and the problem persists
This is the complete output:

06-03 23:24:15.266 25479-25503/com.example.mymachine.nitritetest E/DataGateSyncTemplate: Remote error while acquiring lock
                                                                                       org.dizitart.no2.exceptions.SyncException: NO2.11021: HTTP/1.1 403 Forbidden
                                                                                           at org.dizitart.no2.sync.DataGateSyncTemplate.trySyncLock(DataGateSyncTemplate.java:206)
                                                                                           at org.dizitart.no2.sync.SyncService.pushChanges(SyncService.java:93)
                                                                                           at org.dizitart.no2.sync.CollectionReplicator.run(CollectionReplicator.java:60)
                                                                                           at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:428)
                                                                                           at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:278)
                                                                                           at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:273)
                                                                                           at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1133)
                                                                                           at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:607)
                                                                                           at java.lang.Thread.run(Thread.java:761)
06-03 23:24:15.270 25479-25531/com.example.mymachine.nitritetest I/datagate: Collection: Books ErrorMessage: NO2.11012: error while acquiring lock to remote collection EventType: REPLICATION_ERROR

this looks like a credentials problem, i'm using the admin user that i created manually in mongo.

[ariel-lenis]

This is how looks like the admin document in users collection.

{
    "_id" : ObjectId("someId"),
    "userName" : "admin",
    "password" : "mypassword",
    "accountNonExpired" : true,
    "accountNonLocked" : true,
    "credentialsNonExpired" : true,
    "enabled" : true,
    "authorities" : [ 
        "ADMIN", 
        "admin"
    ]
}

[anidotnet]

For syncing, in the mongo collection no2.datagate.users, there are 2 sets of credentials needed.

1. The user credential
2. The client credential

Client credential is required to create the user credentials in the database. It's the authorization required to create a sync user in the mongo database. From your app you can create a sync user, but to do that you need client credential. Once the user credential is created, it can be used for sync purpose. For clarification, please check the test case - SyncIntegrationTest.java

The user credential will have authority USER and client credential will have authority CLIENT. ADMIN authority is for portal only, it does not have permission for syncing data. So in your case, if you add USER as another authority in your admin document, you will be able to sync.

I'll try to add this to the documentation.

[ariel-lenis]

Yes! you are right

Worked for my with this steps:

1. Created a client user using mongo db manually
2. Created a new user programatically with the client user
3. Synchronized the collections using the user account

One additional question please, is possible to have users with readonly rights?

I want to create a shared collection between many users that will just PULL the data
But also will have a small group of users with write permissions to PUSH updates.

Thanks for your help!!!

[anidotnet]

From what I understand from your question, you can achieve this by configuring your syncHandle depending on the user. For readonly user, configure syncHandle with replication type PULL, for others with replication type BOTH_WAY.

Let me know if I misunderstood you.

[ariel-lenis]

Yes! That can works but in my case that logic will be in the client side (will be a little insecure to use an "if" to validate that in client side).

I am thinking in some kind of validation in server side that tells me: "you have no rights to push" if i am a readonly user

[anidotnet]

Care to elaborate why do you think the approach is insecure?

It does not make sense to me to put access control in server side for syncing. Had it been normal database read-write it would make sense. But in case of restricting automated replication it does not make sense. It should better be served from client side. Based on the user logged in at the client side in your app, either you enable sync or you don't.

Moreover, sync is triggered by and driven from client side only. The server side is just a thin REST layer on top of database itself. When you create a user from your app, you can put your own custom authority for a user, say READONLY_USER. Now in your app query the user details from the server using

public UserAccount getUserAccount(String username)

of DataGateUserTemplate. Based on the custom authority you can set the replication type PUSH, PULL or BOTH_WAY.

Believe me, in an automated background operation like sync, throwing server error continuously like "you have no rights to push" is not a good approach.

[ariel-lenis]

Well in this case i'm planning to use two kind of users:

Readers

• That will use the information from a mongo collection in the server side (lets say Books) using datagate
• The books collection is not unique for every user, is shared between all of them
• The reader users cant modify the books collection

Editors

• The editors have special rights to upload, delete and create new content
• To update the shared collection i'm planning to use datagate

Also, the code will be open source.

But i'm worry about someone can change the PULL for PUSH lines in the code and compile the modified version (create a new apk) to modify the server collection.

[anidotnet]

In that case I would suggest don't enable sync at all for the shared collection. If you think anyone can change PULL or PUSH line, what is stopping them to create/modify a user permission from the app with WRITE access?

The thumb rule is don't manage a shared collection using sync. Write your own database access layer with your own access control for shared collection. Use sync only for the collection which is owned by a specific user only like config or user data etc.