Plugin doesn't connect to jobe server

Plugin doesn't connect to jobe server

by Wilfried Baumann -
Number of replies: 12

We have installed a local jobe server.
We can connect to this jobe server with the testsubmit.py script successfully.
(Works locally from intranet and from outside)
After changing  log_threshold = 2, a log file is created in /var/log/jobe.
However when using the exact same configuration (jobe server address, no port because default port 80 is used, API key) in the plugin, it does not connect. Error message:

"Error from the sandbox [jobesandbox]: Unauthorised to use sandbox"

No log is created on jobe server.


Thanks for any suggestions



Tags:
In reply to Wilfried Baumann

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

Have you turned on API-Key authentication on Jobe? An invalid API key gives that error.

Richard

In reply to Richard Lobb

Re: Plugin doesn't connect to jobe server

by Wilfried Baumann -

Thanks for the interesting hint. Yes, I turned it on.

In rest.php I put:

$config['rest_enable_keys'] = TRUE;

I proceeded as described in https://github.com/trampgeek/jobe
under: "Securing with API keys".

(content of table keys is one record with::
id 1
key ...
level 0
ignore_limits 0
is_private_key 0
ip_addresses NULL
date_created ...)

Now when I run testsubmit.py it will only succeed with the correct api key and fail otherwise.

But still the same problem with the plugin. Same error (Unauthorised to use sandbox) and no log created on jobe server.

Regards, W

Edit:
Interestingly the same thing happens when using
"jobe2.cosc.canterbury.ac.nz"
and the standard api-key.


In reply to Wilfried Baumann

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

That's interesting. Sites all over the world seem able to access jobe2 using an API key - 116 different sites already this May, for example. I just quickly checked that it's still working today and all looks good.

No one has ever reported this problem before, so I think there must be something unusual about your Moodle server, your network or your firewall. At this point, I'm somewhat baffled. To help narrow down the problem, could you please try running testsubmit.py or, better, the lightweight simpletest.py to connect to our Jobe server from different places? I recommend firstly running it on the Moodle server itself, then on other hosts on campus. You could try connecting to your own jobe server from the same set of places, too.

I look forward to hearing what happens.

Richard

In reply to Richard Lobb

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

Although it's a bit off track ... do you actually need API key access control? I've only ever once set up a Jobe server with API keys, and that's jobe2. Usually a jobe server services only a single moodle server. So you can firewall Jobe to allow access only from that server and dispense with the unnecessary complication of API keys.

Richard

In reply to Richard Lobb

Re: Plugin doesn't connect to jobe server

by Wilfried Baumann -

Thanks for your reply. You are making a good point. Unfortunately I have already tried that.
I've put: 

$config['rest_enable_keys'] = FALSE;

in rest.php and after that, testsubmit works with any key.
But the problem with the plugin persists even after deleting the api key from the plugin configuration.

Next thing I will try is check if there is a problem with the moodle server.

 




In reply to Wilfried Baumann

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

Interesting.

Just to clarify: are you saying testsubmit, running on the Moodle server, can connect to your own Jobe server, but Moodle can't? That's very odd.

One other question: what error message are you getting from CodeRunner when using your own Jobe server with API keys turned off?

Richard

In reply to Richard Lobb

Re: Plugin doesn't connect to jobe server

by Wilfried Baumann -

Thanks for your answer. No, we don't have shell access on the moodle machine but connection to Jobe server (by testsumbmit.py) worked from within our office as well as from home.

Error message in plugin is always:

"Error from the sandbox [jobesandbox]: Unauthorised to use sandbox"

Only a wrong address under "Jobe server" in CodeRunner plugin configration would give:

"Error from the sandbox [jobesandbox]: Unexpected error while executing your code. Your code may be too slow, or the sandbox server may be down or overloaded"

In reply to Wilfried Baumann

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

Ah, ok, now that I see the full picture I think I see what the problem is, too. Jobe uses a RESTful protocol. The client sends an HTTP request (GET, POST or PUT) and the server's response code indicates the status of the request. If API keys are required, the return code for a bad key is 403 Forbidden. That results in the particular error message you're seeing.

However, since you're seeing this error message even with API keys disabled on your local Jobe server, and you're getting the problem only when using CodeRunner on your Moodle server (not from various other machines, using testsubmit) I'm pretty sure that the 403 response is coming from a firewall either in the Moodle server itself or between the Moodle server and your Jobe server.

Time to talk to your IT staff?

Richard

In reply to Richard Lobb

Re: Plugin doesn't connect to jobe server

by Wilfried Baumann -

Just succeeded. Talked to the hosters of the moodle server. Port 80 had to be opened.
(Only 443 was open by default)

Richard, thank you so much for your time and your patience.
I hope others will profit from that thread.
CodeRunner is a cool piece of software, I really wanted to get that running.


Edit:  apparently I got confused by the error message. I did not think the "Unauthorised to use sandbox" was caused by such a connection problem.

In reply to Wilfried Baumann

Re: Plugin doesn't connect to jobe server

by Richard Lobb -

Hi Wilfried

Good to know the problem is now solved. Sorry it took me so long to diagnose, but I've never seen a firewall responding with a 403 message when blocking a request. In my opinion, it has no right to do so. The official w3.org spec says of 403 "The server understood the request, but is refusing to fulfill it." There is no mention of this response code being used by an intermediary like a firewall. Is your Moodle server running on Microsoft IIS, perhaps? I read just yesterday that Microsoft (bless its dear little independent heart) has its own extended set of HTTP response codes, including "403.4 - SSL required" and "403.6 - IP address rejected." Those sound like they might be used by IIS for firewalling.

I'll update the error message to indicate that a firewall might also be the problem.

Richard
 

In reply to Richard Lobb

A problem on Windows-based Moodle servers

by Richard Lobb -

Hi again Wilfried

Being reminded again of the existence of Windows-based Moodle servers, I just checked the state of a fix I rolled out on 1 Jan 2018 that affected the python2, python3, octave-function and java-method question types on Windows-based Moodles. I discover that I actually re-introduced the bug on 27 January. So if I'm right that you're using a Windows-based Moodle, and you're using one of those 4 question types, I'm afraid you'll need to go through the process described in the last two postings of the thread entitled "Issues with the Check button" to fix the prototypes. Sorry about that. I really will fix it properly next time :)

Richard

In reply to Richard Lobb

Re: A problem on Windows-based Moodle servers

by Wilfried Baumann -

Dear Richard,

thanks for the additional help. No, I would be surprised if the server is anything else than a plain LAMP system.
Apache is confirmed, the rest I will check later.

Regards, Wilfried