question

Upvotes
nleogas avatar image
15 ●4 ●6 ●4

On-Demand not working as expected

I’m seeing some weird behavior with the On-Demand feature, and was hoping someone can help me out. I have a user permissioned for the IDN vendor service, the base PRODUCT WWDSINPSP, no static Exchange Subservice permissions, and the NYS On-Demand Subservice permission.

What I observe is the following:

  • When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to false, it returns Denied, as expected.
  • When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to true, it returns Allowed, as expected, but it does not turn on the corresponding permission in DACS! In other words, the Subscription Status for NYS on the On-Demand tab in DACS remains as Denied.
  • When I issue a checkSubscription request for a NYS PE code via the OpenDACS API with the On-Demand flag set to false, it again returns Denied, proving that the previous request did not turn on NYS.

Does anyone know what’s going on here? Is there a setting I need to turn on in DACS to make this work as expected (i.e. the second request should turn on NYS, so that subsequent requests return Allowed)?

DACSopen-dacs
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

5 Answers

· Write an Answer
Upvotes
Jirapongse avatar image
78.8k ●250 ●52 ●74

It works as expected according to OpenDACS developer guide, as shown below.

NYS is set as On-Demand so, to allow access, it needs to be checked with CONSIDER_DOD_ENABLE.


dod.png (56.3 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

nleogas avatar image nleogas

I am setting the considerDOD flag (second request in my example). However, I expect that doing so will permanently entitle the user for NYS, which does not happen.

Upvotes
veerapath.rungruengrayubkul avatar image
11.3k ●25 ●9 ●14
@nleogas

It might be related to the DACS sink daemon version, the Open DACS application is connecting to. Could you verify the version of DACS Sink daemon? Also, you may modify your Open DACS application to connect remotely to the daemon running on your DACS server.

From my testing, if my Open DACS application connects to old version of DACS Sink daemon (6.3), my application gets the same result as yours. After the permission is granted with On-Demand flag = true, the application has gotten access denied with the On-Demand flag = false.

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

nleogas avatar image nleogas

The Sink Daemon version is the same as for DACS itself (v. 7.1.0).

Upvotes
Nipat Kunvutipongsak avatar image
1.9k ●7 ●10 ●16

Hello @nleogas,

Unfortunately, I can't replicate this problem. Here there are my settings.

Environment:

  • DACS 7.0.L1
  • Open Dacs Java 7.5.0.L1 (by using a DacsSubscribeClient example)
  • Connecting DACS Sink Daemon >> use the DACS Server machine

Test Data:

  • RIC = "AAPL.O"
  • PE code = "74"

Setup:

  • [Normal Permission] Product Code = "USDLATAMSERV"
  • [On-Demand Permission] Exchange = "NAS1" or "NA1"

I followed your test step, but I got the different result from you (see the attachment).

What is the Open Dacs Java version that you are using? Is it 7.5.0.L1?


dod-test-comparison.png (457.5 KiB)
icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

nleogas avatar image nleogas

Thank you for the detailed response. I'm using DACS 7.1.0.F2 and OpenDACS Java 6.6.0.F2.

Nipat Kunvutipongsak avatar image Nipat Kunvutipongsak nleogas

@nleogas,

I've found this piece of information from DACS 7.1 document.

I'm not sure whether this problem relates to a library version or not. Is it possible for you to replicate this problem with OpenDACS Java newer version such as 7.5, 7.6 or 8.0?

(You can download the latest version from https://developers.thomsonreuters.com/thomson-reuters-enterprise-platform/open-data-access-control-system-api-0/downloads).

dod-concerns.png (99.6 KiB)
nleogas avatar image nleogas Nipat Kunvutipongsak

The issue is reproducible even with more recent OpenDACS versions.

Upvotes
nleogas avatar image
15 ●4 ●6 ●4

Per Reuters support, the issue was fixed by enabling usage logging for the Sink Daemon (per the instructions here).

However, even after that, the Subservice permission does not show up in the DACS UI until 30 minutes or so after the On-Demand request. The permission shows up immediately if a usage collection is performed in the UI.

Is this how it's supposed to work? I'm astonished by the fact that an On-Demand granted permission needs 30 minutes to propagate through the system!

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Nipat Kunvutipongsak avatar image   Nipat Kunvutipongsak

Escalated to DACS 3rd support team.

Hello @mahesh.bommanayakanahalli,

Have you encountered this DACS on-demand issue like this before?

In our environment, we have DACS 7.0.L1 only, but the customer uses 7.1. So, I'm not sure whether the version relates to this problem or not because I can't replicate this problem using 7.0.L1 either.

If you think there should be a case for investigating this problem, please feel free to let me know then.

Nipat Kunvutipongsak avatar image   Nipat Kunvutipongsak

Dear nleogas,

I'm terribly sorry for the late reply.

Please confirm the problem statement before we create/escalate a new ticket to DACS support team via ticket as follows:

1. The original query is permission can't be granted even though the on-demand feature has already permitted for the particular item requested.

2. Later on, this problem can be solved by enabling usage logging.

3. The next problem is that DACS UI doesn't show the sub-service permission until 30 minutes later after on-demand request or usage collected.

Please let me know if there's something that I've overlooked.

Upvotes
nleogas avatar image
15 ●4 ●6 ●4

To summarize, these are the issues that could use improvement:

1. On-Demand functionality does not work if usage logging for the sink daemon is not enabled. That's counter-intuitive and not well- documented. I don't see why usage logging should be needed for On-Demand to work.

2. After an On-Demand permission is granted, this fact is not immediately reflected in the DACS Web UI, which is confusing. The UI is correctly updated at the next usage collection. I assume this is related to #1 above.

3. Even after the new permission appears in the UI, a distribution is needed to propagate it to all services in the DACS system (i.e. servers and sink daemons). This partially defeats the automated nature of On-Demand, since a manual action is required to make the new permission fully effective. I think it would make sense to perform an automated distribution specifically for the user in question, right after an On-Demand permission is granted.

icon clock
10 |1500

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.