question

Upvote
Accepted
18 0 0 3

.NET Refinitiv.Data - "Session quota reached" followed by AmazonSQSException

We have a .NET service running 24/7 based on the library provided by LSEG, specifically Refinitiv.Data version 1.0.0-beta5. We have been getting such errors on daily basis, which cause the service to fail. We are using this example https://github.com/LSEG-API-Samples/Example.DataLibrary.DotNet/blob/main/src/3.%20Delivery/3.3-Queue/3.3.02-Queue-NewsStories/3.3.02-Queue-NewsStories.cs

Could you please tell us if we should change something / configure differently?

First there is a sequence of such warnings:

[WARN ] [107] [GrantPassword] RDP Grant Password Authorization failed with Status: "{

"HTTPStatusCode": 400,

"HTTPReason": "Bad Request",

"Contents": {

"error": "access_denied",

"error_description": "Session quota is reached."

}

}"


This happens every 30s for half an hour and are followed by an Exception:

[WARN ] [111] [AWSSubscriber] AWSSubscriber failed to delete SQS message with ID: b2a4b03e-d89b-4287-81ea-57be6cbb8c11.

Amazon.SQS.AmazonSQSException: The security token included in the request is expired

---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown.


at Amazon.Runtime.HttpWebRequestMessage.GetResponseAsync(CancellationToken cancellationToken)

#productnews
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
Accepted
27k 65 17 14

Hello @lukasz.druczak

It seems there is a connection problem between your environment and the RDP Gateway. I strongly suggest you contact the RDP support team to investigate these errors (Gateway Time-Out, internal server error, and Session quota reached) that might relate to the server side. You can submit a support ticket to the RDP support team via https://myaccount.lseg.com/en/productsupport website.

contact-rdp-news.png


icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvote
18.9k 85 39 63

Hi @lukasz.druczak

Are you by chance running another instance of your application using the same credentials? The message is typically associated when another application effectively "steals" your session/access thus invalidating your current session/access. Your credentials are only entitled to a single session.

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
18 0 0 3

Hi @nick.zincone , there are times that we need to use the same credentials for non-prod environment, so that would match the times when we see these errors. Can you let us know what we can do about it? Is there any setup that we could use for our account?

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
18.9k 85 39 63

Hi @lukasz.druczak

What you can do is try using the email account ID that you would normally use on the API Playgound. This ID was provided to you when you signed up and should be able to use to periodically test in the non-prod environment. Another option is to reach out to you LSEG account manager - they may be able to arrange for an ID.

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
18 0 0 3

Hi @nick.zincone, thank you, it worked like a charm.

Could you please tell what does it mean the Playground account can be used periodically? Does it have any limitations compared to the other ID? Would our subscription to news stop working when using the playground account?

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Hello @lukasz.druczak

There are two type of accounts:

  • The User-ID account (email based): This account type aims for using with the API Playground page by developers/QA to explorer the RDP APIs capabilities.
  • The Machine-ID account (GE-A-XXXXXXXX-X-XXXX): This account type aims for using with an actual application on Dev, Test, or Production environments.

You should have both User-ID account and associates Machine-IDs accounts, they should have the same permission.

If you are using a single account (either User-ID or Machine-ID type) with multiple applications or sessions, applications may encounter this kind of error when an access token expires or when the applications attempt to refresh an access token.


Hi @wasin.w , thanks for your answer.

Could you tell me how to approach such situation? As I understand we cannot use the same credentials for more than instance of our app? I have noticed that even if I create a separate app key for the same credentials I still get the error. Shall we have multiple account IDs or is there any other approach we cant take?

Hello @lukasz.druczak

I strongly suggest you reach out to your LSEG representative/Account Manager to generate multiple Machine-IDs for you.

Show more comments
Upvotes
27k 65 17 14

Hi @lukasz.druczak

Question: How do I generate app key for our DEV_ playground account and for machine IDs we were given? Should I generate separate app key for each of the IDs?

Answer:

You can use a single app-key with multiple Machine-IDs. The session quota is based on the Machine-ID only.

However, if you need to create new app-key(s), you can do it by clicking the "AppKey Generator" Link on the top left corner of the API Playground page.

api-playground.png

Then on the AppKey Generator website, input your app-key name, and check a "EDP API" box for the RDP API as follows:

api-app-key.png


api-playground.png (59.6 KiB)
api-app-key.png (49.8 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
18 0 0 3

Hi @wasin.w , thank you.

Do I use the DEV_ playground account to generate key for the Machine IDs? Just wondering how are the DEV_ account and the Machine IDs connected?

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Hello @lukasz.druczak

Yes, you need to use your User-ID (email based) that can access the API Playground website to generate the App-Key. Then use that App Key as a "client_id" with the Machine-ID and its password on an application.

However, I do not have a detail how the User-ID, Machine-ID, and App-Key are link together. If you need to understand a technical detail about it, I strongly suggest you contact the RDP support team.

Upvotes
18 0 0 3

hi @wasin.w

We have been using different Machine IDs with shared App Key for our service over the weekend. We have used the IDs (credentials) per environment and not used them anywhere else, so we do not steal sessions and do not get "Session quota reached."

However, we have hit the errors (for let's say ID = 1 and ID = 2) at night on 7th of July at around the same time, just after midnight and once for one ID = 1 on the 8th of July. They were only 3 instances of these errors since Friday, but still they occurred and we have not used the credentials elsewhere.

Can you advise what might have happened? Was there any maintenance or sth?

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Hello @lukasz.druczak

Can you please explain more about the error?

  • The error message, status code, etc .
  • Replication steps (if any)
  • Can you replicate the issue on demand?

About the RTO maintenance windows, you can find more detail on section 5 “Product & Usage” of the https://my.refinitiv.com/content/dam/myrefinitiv/products/11514/en/Technical/623743.pdf document.

hi @wasin.w

It is not replicable, as we got it at night in our running services on different environments, as described in previous message. It was for all a sequence of :

[GrantPassword] RDP Grant Password Authorization failed with Status: "{
  "HTTPStatusCode": 400,
  "HTTPReason": "Bad Request",
  "Contents": {
    "error": "access_denied",
    "error_description": "Session quota is reached."
  }
}"

and after 30-40 mins:

Amazon.SQS.AmazonSQSException: The security token included in the request is expired
 ---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown.
   at Amazon.Runtime.HttpWebRequestMessage.GetResponseAsync(CancellationToken cancellationToken)
   at Amazon.Runtime.Internal.HttpHandler`1.InvokeAsync[T](IExecutionContext executionContext)
   at Amazon.Runtime.Internal.Unmarshaller.InvokeAsync[T](IExecutionContext executionContext)
   at Amazon.SQS.Internal.ValidationResponseHandler.InvokeAsync[T](IExecutionContext executionContext)
   at Amazon.Runtime.Internal.ErrorHandler.InvokeAsync[T](IExecutionContext executionContext)
   --- End of inner exception stack trace ---
   at Refinitiv.Data.Delivery.Queue.AWSSubscriber.<>c__DisplayClass23_0.<StartPollingAsync>b__1(Task`1 t)



Hi @lukasz.druczak

Can you clarify the following? You did mention this:

"...we do not steal sessions and do not get "Session quota reached.""

But above indicates you are getting "Session quota reached". If you do get "Session quota reached", your access token will eventually expire which explains the above "The security token included in the request is expired".

I would start with a simple test. Just 1 ID and leave it running and ensure no one else is using that ID. Let it run for days, if possible. Then startup a new instance using a new ID/Password and continue from there. If you begin to see "Session quota is reached" and you know you are not using the ID anything else, then the next step is to involve the backend server team to monitor the activity of your IDs because it is the backend that is complaining.

Upvotes
27k 65 17 14

Hello @lukasz.druczak

I admit that I am not the Data Library - .NET expert, but this error message should not happen if you are using multiple Machine-IDs.

Did you set the TakeSignonControl parameter to True when initialize a session?

var session = PlatformSession.Definition().AppKey(Credentials.AppKey)
                .OAuthGrantType(new GrantPassword().UserName(Credentials.RDPUser)
                .Password(Credentials.RDPPassword))
                .TakeSignonControl(true)
                .GetSession().OnState((state, msg, s) => Console.WriteLine($"State: {state}. {msg}"))
                .OnEvent((eventCode, msg, s) => Console.WriteLine($"Event: {eventCode}. {msg}"));

Example: 1.1 - PlatformSession.cs

@nick.zincone Do you have other ideas?

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

hi @wasin.w , yes this is what we use

.TakeSignonControl(true)

Hi @wasin.w @nick.zincone

We got another such situation, but in this case before we started getting "Session quota reached." responses, there was this response

[GrantPassword] RDP Grant Refresh Authorization failed with Status: "{
  "HTTPStatusCode": 504,
  "HTTPReason": "Gateway Time-out",
  "Contents": "<html>\r\n<head><title>504 Gateway Time-out</title></head>\r\n<body>\r\n<center><h1>504 Gateway Time-out</h1></center>\r\n</body>\r\n</html>\r\n"
}"

I did some digging regarding the situations over the weekend from my previous post, and it was similar, but we got 500 before we started getting "Session quota reached." responses.

[GrantPassword] RDP Grant Refresh Authorization failed with Status: "{
  "HTTPStatusCode": 500,
  "HTTPReason": "Internal Server Error",
  "Contents": {
    "error": {
      "id": "6faf7760-e5ca-4d7f-b426-a48d6aa8b224",
      "code": "500",
      "message": "internal server error",
      "status": "Internal Server Error"
    }
  }
}"

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.