question

Upvotes
Accepted
114 8 18 27

EMA: cannot authenticate towards RTO

Hello LSEG,

we're working to setup an application based on the EMA C++ library for connections towards RTO.

Context:

  • the execution environment is currently under investigations (with some of you guys from LSEG) for some network issues preventing a complete communication with RTO
  • recently, some issues have been resolved in order to allow V2 authentication towards RTO, via Delivery Direct
  • the network setup is still under analysis for what regards the service discovery step

Let me focus on the authentication part.

We have been using a python sample based on the Refinitiv WebSocket API.

The sample can authenticate with success using the URL https://us-east-1-api.refinitiv.biz/auth/oauth2/v2/token (see attached material).

While the service discovery requirements are being analyzed from the networking point of view, we've tried to test the authentication step with an EMA based application and the same V2 URL.

However, it seems that the authentication step is not working, or at least we don't know how to determine whether it was successful or not from the output.

Please find in attachment the EmaConfig.xml file used for the test, and the log generated during the run.

Ps: we've also done the same test using:

What do you think might be the root cause of the issue?

Do the Python WebSocket API and the EMA (C or Java) APIs use different protocols or channels for authentication with RTO?

Do you see anything incorrect in the configuration used?

Anything else that we can check?

Some additional details:


Test material: auth-rto-tests.zip

Thanks,

Paolo

ema-apiauthenticationrefinitiv-realtime-optimisedrefinitiv-realtime-sdk
auth-rto-tests.zip (292.4 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
Accepted
27.6k 67 18 14

Hello @Paolo Parlapiano

Please check my colleague @Jirapongse answer about the EnableSessionManagement parameter setting.

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
27.6k 67 18 14

Hello @Paolo Parlapiano

I am not the EMA C++ expert, but there are 2 points that might help you.

First: Set the DeliveryDirect Authentication and Service Discovery URLs

I see that you are trying to connect to RTO via a DeliveryDirect network. Did you run the Cons113 with the following parmaters?

  • -tokenURLV2: specify the RDP Authentication URL for the DeliveryDirect
  • -serviceDiscoveryURL: specify the RDP Service Discovery URL for the DeliveryDirect

If you did not specify those parameters, the EMA uses a default RDP public connection endpoint (https://api.refiniti.com/xxxx).

Second: EncryptedProtocolType

The default configuration of the EmaConfig.xml should work fine without any modification on the EncryptedProtocolType paramter. Did you install the OpenSSL on that machine yet?

This How to Build OpenSSL, zlib, and cURL libraries on Windows article might help you.


icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
27.6k 67 18 14

Hello @Paolo Parlapiano

I checked the attachment file.

The error message "Initialization timed out." on C++ and "login failed (timed out after waiting for 45000 milliseconds) for <endpoint>." on Java API mean the API success to authenticate with RDP, but fail to connect to the RTO endpoint.

Based on the given Java capture screen, the steps are as follows:

  1. The API got authentication from the RDP Authentication service (us-east-1-api.refinitiv.biz/auth/oauth2/v2/token)
  2. The API got endpoints list from the RDP Service Discovery
  3. However, the API cannot establish a connection with the RTO endpoint (us-east1-xxxx-api.refinitiv.biz) on port 14002 on time (45000 milliseconds)

You can try to set the LoginRequestTimeout parameter on the EmaConfig.xml file to increase the waiting time to establish a connection with the RTO RSSL server.

loginrequesttimeout.png

If it does not help, I strongly suggest you contact the RTO Support team to verify why an application cannot establish a connection to that us-east-1-aws-2-med.optimized-pricing-api.refinitiv.biz endpoint via DeliveryDirect. You can contact the team via the https://myaccount.lseg.com/en/productsupport website.

1727688391178.png



icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
114 8 18 27

Thanks for the clarifiaction @wasin.w,

it was actually expected that the final connection with RTO would fail, I just wanted to check that the login to RDP at least worked, but I could not be sure of the outcome.

Best Regards,

Paolo

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
86.3k 292 53 79

@Paolo Parlapiano

To connect to RTO, you need to set the EnableSessionManagement to 1 in the Channel.

1727690154785.png



1727690154785.png (32.6 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
114 8 18 27

Thanks,

I'll add the setting and make a new run.

Regards,

Paolo

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvotes
114 8 18 27

Hello,

I've done a new test using EnableSessionManagement set to 1, however from the output I didn't spot any particular difference. As double confirmation, and considering that for networking reasons it's expected that the API cannot establish a connection with the RTO endpoint, can I conclude that the output in attachment shows a successful authentication step to the RDP service anyway?

ion_consumer_log.txt

Thank you

Best Regards,

Paolo


icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Upvote
86.3k 292 53 79

@Paolo Parlapiano

For EMA C++, you can enable REST log to verify the authenticaion process by using the following configurations (RestEnableLog and RestVerboseMode) in the Consumer setting.

        <Consumer>
            <Name value="Consumer_4"/>
            <ChannelSet value="Channel_4"/>
            <Logger value="Logger_1"/>
            <Dictionary value="Dictionary_1"/>
            <XmlTraceToStdout value="0"/>
            <RestEnableLog value="1"/>
            <RestVerboseMode value="1"/>
        </Consumer>
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

thanks, with additional logging enabled, I could verify that the authentication phase is working as expected.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.