Gramps web sync - insufficient permissions

Gramps Web
21

https://gramps.malakan.co.uk for both the sync addon and browser

image
image405×163 9.08 KB

22

Please check if this works (don’t post the token here…)

curl -X POST https://gramps.malakan.co.uk/api/token/ \
     -H "Content-Type: application/json" \
     -d '{"username": "desktop", "password": "YOUR_PASSWORD"}'
23

Also, please make sure the user desktop is actually a tree owner, not just editor. That could also explain the error.

24

desktop was not a owner but error still occurs with the owner account.

As for the curl and with the owner account details, I get json back with an access_token and refresh_token.

25

Which error do you get in sync addon using the owner account and triple checking that the password is correct?

26

The same error as before, after tripple checking username and password:

Server authorization error: insufficient permissions.

I also tried resetting the password but I get the same error.

27

Ok, here is a combination of things that I think are simply impossible:

  1. You see log entries like grampsweb | [2024-12-05 09:29:25 +0000] [14] [DEBUG] GET /api/metadata/ when using Gramps Web
  2. You do not see log entries when connecting with the sync addon
  3. The sync addon responds with Server authorization error: insufficient permissions.

The reason I think this is impossible is that 3. is only possible if the server responds with 403, as shown by the code snippet above. But if the server responds, you must see the request.

The only other explanation is that you have some weird authenticating proxy or something in between, that you didn’t mention here.

28

I don’t understand it myself, thank you so much for spending your time in helping me with this!

I don’t have an authenticating proxy that I’m aware of.

So my setup in full, as it may help shine a light on the issue:

  1. I have a domain via cloudflare, I have A records pointing to me.
  2. My home router is set to forward http/https/ssh requests to the server itself
  3. The server (old laptop) is running docker-compose and setup with let’s encrypt following this guide.
  4. I have nginx reverse proxy setup inline with the guide and is the only proxy I have.

Would my docker-compose.yml and nginx.conf help to diagnose here?

29

When you did the curl, did you see a log entry
grampsweb | [...] [14] [DEBUG] GET /api/token/?

30

I see this

“POST /api/token/ HTTP/2.0” 200 813 “-” “curl/8.5.0”

1 Like
31

Great. And when you use sync, this does not show up? Sorry for asking the same thing again and again, just can’t wrap my head around this :sweat_smile:

32

In my nginx.conf file I have

access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;

in both the http block and the server block.

I see the POST log in access.log each time I do the curl command, nothing appears in access.log or error.log when attempting to use sync.

33

I don’t know if this is relevant to the situation but might be something:

curl -w ‘%{http_code}’ https://gramps.malakan.co.uk

results in

curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_NO_REVOCATION_CHECK (0x80092012) - The revocation function was unable to check revocation for the certificate.
‘000’

but removing https:// from the url and adding in the -ssh flag I get a different response

curl -w ‘%{http_code}’ -ssl gramps.malakan.co.uk

results in

301 Moved Permanently

301 Moved Permanently

nginx ':301'

so if i curl with https:// it seems I’m get blocked by the certificate?