Is GROUP_All_Users@firecloud.org gone?

Post author
David Heiman

We have an external bucket that has GROUP_All_Users@firecloud.org set as a Storage Object Viewer. At least a week ago, this enabled any FireCloud/Terra workflow to access files from that bucket.

Now when I look at the monitor tab for a workflow that uses the bucket (gs://getzlab-workflows-reference_files-oa) and click the link, I get the following error:

{"status":500,"response":{"req":{"method":"GET","url":"https://sam.dsde-prod.broadinstitute.org/api/google/v1/user/petServiceAccount/key","headers":{"user-agent":"node-superagent/3.8.3","authorization":"Bearer <Token Redacted>"}},"header":{"date":"Thu, 30 May 2019 22:06:04 GMT","server":"akka-http/10.1.7","x-frame-options":"SAMEORIGIN","access-control-allow-origin":"*","access-control-allow-headers":"authorization,content-type,accept,origin,x-app-id","access-control-allow-methods":"GET,POST,PUT,PATCH,DELETE,OPTIONS,HEAD","access-control-max-age":"1728000","content-type":"application/json","content-length":"5232","via":"1.1 google","alt-svc":"clear","connection":"close"},"status":500,"text":"{\"causes\":[],\"exceptionClass\":\"com.google.api.client.googleapis.json.GoogleJsonResponseException\",\"message\":\"403 Forbidden\\n{\\n  \\\"code\\\" : 403,\\n  \\\"errors\\\" : [ {\\n    \\\"domain\\\" : \\\"global\\\",\\n    \\\"message\\\" : \\\"User is not authorized.\\\",\\n    \\\"reason\\\" : \\\"forbidden\\\"\\n  } ],\\n  \\\"message\\\" : \\\"User is not authorized.\\\",\\n  \\\"status\\\" : \\\"PERMISSION_DENIED\\\"\\n}\",\"source\":\"sam\",\"stackTrace\":[{\"className\":\"com.google.api.client.googleapis.json.GoogleJsonResponseException\",\"fileName\":\"GoogleJsonResponseException.java\",\"lineNumber\":150,\"methodName\":\"from\"},{\"className\":\"com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest\",\"fileName\":\"AbstractGoogleJsonClientRequest.java\",\"lineNumber\":113,\"methodName\":\"newExceptionOnError\"},{\"className\":\"com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest\",\"fileName\":\"AbstractGoogleJsonClientRequest.java\",\"lineNumber\":40,\"methodName\":\"newExceptionOnError\"},{\"className\":\"com.google.api.client.googleapis.services.AbstractGoogleClientRequest$1\",\"fileName\":\"AbstractGoogleClientRequest.java\",\"lineNumber\":401,\"methodName\":\"interceptResponse\"},{\"className\":\"com.google.api.client.http.HttpRequest\",\"fileName\":\"HttpRequest.java\",\"lineNumber\":1097,\"methodName\":\"execute\"},{\"className\":\"com.google.api.client.googleapis.services.AbstractGoogleClientRequest\",\"fileName\":\"AbstractGoogleClientRequest.java\",\"lineNumber\":499,\"methodName\":\"executeUnparsed\"},{\"className\":\"com.google.api.client.googleapis.services.AbstractGoogleClientRequest\",\"fileName\":\"AbstractGoogleClientRequest.java\",\"lineNumber\":432,\"methodName\":\"executeUnparsed\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":70,\"methodName\":\"$anonfun$executeGoogleCall$1\"},{\"className\":\"scala.util.Try$\",\"fileName\":\"Try.scala\",\"lineNumber\":209,\"methodName\":\"apply\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":70,\"methodName\":\"executeGoogleCall\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":67,\"methodName\":\"executeGoogleCall$\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.AbstractHttpGoogleDAO\",\"fileName\":\"AbstractHttpGoogleDAO.scala\",\"lineNumber\":14,\"methodName\":\"executeGoogleCall\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":51,\"methodName\":\"executeGoogleRequest\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":50,\"methodName\":\"executeGoogleRequest$\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.AbstractHttpGoogleDAO\",\"fileName\":\"AbstractHttpGoogleDAO.scala\",\"lineNumber\":14,\"methodName\":\"executeGoogleRequest\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.HttpGoogleProjectDAO\",\"fileName\":\"HttpGoogleProjectDAO.scala\",\"lineNumber\":52,\"methodName\":\"$anonfun$createProject$3\"},{\"className\":\"scala.concurrent.impl.ExecutionContextImpl$DefaultThreadFactory$$anon$2$$anon$3\",\"fileName\":\"ExecutionContextImpl.scala\",\"lineNumber\":71,\"methodName\":\"block\"},{\"className\":\"java.util.concurrent.ForkJoinPool\",\"fileName\":\"ForkJoinPool.java\",\"lineNumber\":3313,\"methodName\":\"managedBlock\"},{\"className\":\"scala.concurrent.impl.ExecutionContextImpl$DefaultThreadFactory$$anon$2\",\"fileName\":\"ExecutionContextImpl.scala\",\"lineNumber\":83,\"methodName\":\"blockOn\"},{\"className\":\"scala.concurrent.package$\",\"fileName\":\"package.scala\",\"lineNumber\":142,\"methodName\":\"blocking\"},{\"className\":\"org.broadinstitute.dsde.workbench.google.GoogleUtilities\",\"fileName\":\"GoogleUtilities.scala\",\"lineNumber\":42,\"methodName\":\"$anonfun$retryWhen500orGoogleError$3\"},{\"className\":\"scala.concurrent.Future$\",\"fileName\":\"Future.scala\",\"lineNumber\":654,\"methodName\":\"$anonfun$apply$1\"},{\"className\":\"scala.util.Success\",\"fileName\":\"Try.scala\",\"lineNumber\":251,\"methodName\":\"$anonfun$map$1\"},{\"className\":\"scala.util.Success\",\"fileName\":\"Try.scala\",\"lineNumber\":209,\"methodName\":\"map\"},{\"className\":\"scala.concurrent.Future\",\"fileName\":\"Future.scala\",\"lineNumber\":288,\"methodName\":\"$anonfun$map$1\"},{\"className\":\"scala.concurrent.impl.Promise\",\"fileName\":\"Promise.scala\",\"lineNumber\":29,\"methodName\":\"liftedTree1$1\"},{\"className\":\"scala.concurrent.impl.Promise\",\"fileName\":\"Promise.scala\",\"lineNumber\":29,\"methodName\":\"$anonfun$transform$1\"},{\"className\":\"scala.concurrent.impl.CallbackRunnable\",\"fileName\":\"Promise.scala\",\"lineNumber\":60,\"methodName\":\"run\"},{\"className\":\"java.util.concurrent.ForkJoinTask$RunnableExecuteAction\",\"fileName\":\"ForkJoinTask.java\",\"lineNumber\":1402,\"methodName\":\"exec\"},{\"className\":\"java.util.concurrent.ForkJoinTask\",\"fileName\":\"ForkJoinTask.java\",\"lineNumber\":289,\"methodName\":\"doExec\"},{\"className\":\"java.util.concurrent.ForkJoinPool$WorkQueue\",\"fileName\":\"ForkJoinPool.java\",\"lineNumber\":1056,\"methodName\":\"runTask\"},{\"className\":\"java.util.concurrent.ForkJoinPool\",\"fileName\":\"ForkJoinPool.java\",\"lineNumber\":1692,\"methodName\":\"runWorker\"},{\"className\":\"java.util.concurrent.ForkJoinWorkerThread\",\"fileName\":\"ForkJoinWorkerThread.java\",\"lineNumber\":157,\"methodName\":\"run\"}]}"}}

(Note: I removed the bearer token from the above error)

I can still access the bucket via the console.

Thanks!

Comments

2 comments

  • Comment author
    Sushma Chaluvadi

    Hi David,

    We are looking to see what may be causing this and will get back to you asap.

    Thanks!

    0
  • Comment author
    Sushma Chaluvadi

    David,

    It seems that there was a permissions issue that we recently fixed so you should no longer be having this issue if you retry. Can you confirm that you are able to successfully run these workflows?

    Thanks!

    0

Please sign in to leave a comment.