On-Demand not working as expected
I’m seeing some weird behavior with the On-Demand feature, and was hoping someone can help me out. I have a user permissioned for the IDN vendor service, the base PRODUCT WWDSINPSP, no static Exchange Subservice permissions, and the NYS On-Demand Subservice permission.
What I observe is the following:
- When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to false, it returns Denied, as expected.
- When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to true, it returns Allowed, as expected, but it does not turn on the corresponding permission in DACS! In other words, the Subscription Status for NYS on the On-Demand tab in DACS remains as Denied.
- When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to false, it again returns Denied, proving that the previous request did not turn on NYS.
Does anyone know what’s going on here? Is there a setting I need to turn on in DACS to make this work as expected (i.e. the second request should turn on NYS, so that subsequent requests return Allowed)?
It works as expected according to OpenDACS developer guide, as shown below.
NYS is set as On-Demand so, to allow access, it needs to be checked with CONSIDER_DOD_ENABLE.
It might be related to the DACS sink daemon version, the Open DACS application is connecting to. Could you verify the version of DACS Sink daemon? Also, you may modify your Open DACS application to connect remotely to the daemon running on your DACS server.
From my testing, if my Open DACS application connects to old version of DACS Sink daemon (6.3), my application gets the same result as yours. After the permission is granted with On-Demand flag = true, the application has gotten access denied with the On-Demand flag = false.
Hello @nleogas,
Unfortunately, I can't replicate this problem. Here there are my settings.
Environment:
- DACS 7.0.L1
- Open Dacs Java 7.5.0.L1 (by using a DacsSubscribeClient example)
- Connecting DACS Sink Daemon >> use the DACS Server machine
Test Data:
- RIC = "AAPL.O"
- PE code = "74"
Setup:
- [Normal Permission] Product Code = "USDLATAMSERV"
- [On-Demand Permission] Exchange = "NAS1" or "NA1"
I followed your test step, but I got the different result from you (see the attachment).
What is the Open Dacs Java version that you are using? Is it 7.5.0.L1?
Thank you for the detailed response. I'm using DACS 7.1.0.F2 and OpenDACS Java 6.6.0.F2.
I've found this piece of information from DACS 7.1 document.
I'm not sure whether this problem relates to a library version or not. Is it possible for you to replicate this problem with OpenDACS Java newer version such as 7.5, 7.6 or 8.0?
(You can download the latest version from https://developers.thomsonreuters.com/thomson-reuters-enterprise-platform/open-data-access-control-system-api-0/downloads).
Per Reuters support, the issue was fixed by enabling usage logging for the Sink Daemon (per the instructions here).
However, even after that, the Subservice permission does not show up in the DACS UI until 30 minutes or so after the On-Demand request. The permission shows up immediately if a usage collection is performed in the UI.
Is this how it's supposed to work? I'm astonished by the fact that an On-Demand granted permission needs 30 minutes to propagate through the system!
To summarize, these are the issues that could use improvement:
1. On-Demand functionality does not work if usage logging for the sink daemon is not enabled. That's counter-intuitive and not well- documented. I don't see why usage logging should be needed for On-Demand to work.
2. After an On-Demand permission is granted, this fact is not immediately reflected in the DACS Web UI, which is confusing. The UI is correctly updated at the next usage collection. I assume this is related to #1 above.
3. Even after the new permission appears in the UI, a distribution is needed to propagate it to all services in the DACS system (i.e. servers and sink daemons). This partially defeats the automated nature of On-Demand, since a manual action is required to make the new permission fully effective. I think it would make sense to perform an automated distribution specifically for the user in question, right after an On-Demand permission is granted.