- Pdb-tech - tcp0.com

OAUTH OIDC provider issues
by Tom Strickx 06 Mar '26

06 Mar '26

Hey, Since the upgrade, our (peering.cloudflare.com) PeeringDB integration broke. Specifically, it looks like we're getting 500s now from https://auth.peeringdb.com/oauth2/token/ We do a POST to that endpoint with the following: redirect_uri: "https://net.cloudflareaccess.com/cdn-cgi/access/callback" code: ... grant_type: 'authorization_code' client_id: ... client_secret: ... We're not too sure what changed, given this used to work, and we haven't touched anything on our end. Does anyone have any idea what could be going on? Or, ideally, someone who can look at the backend and tell us what's dying? Any and all insights appreciated -- Tom Strickx Principal Network Engineer AS13335 - Cloudflare

2 3

new rate limiting mechanism is too strict
by Theo de Raadt 13 May '24

13 May '24

At YYCIX, we run arouteserver, which polls peeringdb. On May 15 (I think) we started seeing failures to download peeringdb records, which has resulted in our routeserver configuration not being updated as usual. I've become aware that the API has a new rate filtering mechanism, for non-APIKEY accesses. Well, arouteserver doesn't do APIKEY, and I don't see how the author of arouteserver would have received any notice that this was suddenly mandatory, nor all the arouteserver users. I think peeringdb should have looked more carefully into the no-APIKEY accesses to determine what downstream effects might occur from this change. Testing further manually, I observe some really crazy behaviour. Using a regular browser, I can keep reloading the same record over and over without hitting any limit. Using a command-line client (curl or OpenBSD ftp(1)), i hit some extremely strict limits very quickly. On the 11th lookup, I receiving this, and it started counting down: {"message": "Request was throttled. Expected available in 59 minutes. Authenticate for less restrictions. For more information: https://docs.peeringdb.com/howto/api_keys/", "meta": {"error": "Too Many Requests"}} All requests are blocked for an hour. I paused, and tried a new lookup every 5 minutes. Half an hour later it allowed me to retrieve 1 record, but then continued the countdown: {"message": "Request was throttled. Expected available in 17 minutes. Authenticate for less restrictions. For more information: https://docs.peeringdb.com/howto/api_keys/", "meta": {"error": "Too Many Requests"}} If the new limit is 10 records an hour, I mean you could really just shut down the service entirely, there's really no difference. I understand using APIKEY is the new way, but the old way has effectively been disabled without notice. But also, why does this work in the browser? I can reload hundreds of times. Is the official browser User-agent being considered exempt from the rule? If so I don't understand what the protection plan is.. maybe we should all change our commandline tools to declare they are Chrome?

5 6

Question about API ratelimits
by Tom Strickx 11 Apr '24

11 Apr '24

Hey folks, We're wondering how the ratelimits are enforced these days. Specifically, authenticated (so with API key) requests. Are these enforced by API-key, by AccountID, by IP, by subnet, by star sign, ...? Let me know if there's some piece of documentation documenting all of this. Thanks! -- Tom Strickx Principal Network Engineer AS13335 - Cloudflare

2 1

OAuth client application help request: cannot get user profile
by Bartosz Miklaszewski 26 Jun '23

26 Jun '23

Hi, I am struggling with this for a while, maybe someone would be abloe to help. In short, i try use flask with oauth but failed on getting token back, moved to django, and I was able to pass token. Now I am receiving token and try to request user profile, but getting Resposne 403 cant figure out why, My code: from django.shortcuts import render from django.http import HttpRequest, HttpResponse, JsonResponse from django.shortcuts import redirect import requests # Create your views here. redirect_url_peeringdb = 'https://auth.peeringdb.com/oauth2/authorize/auth?response_type=code&client_…<client_id>&redirect_uri=https://localhost:8000/oauth2/login/redirect&scope=email&state=1234zyx' client_id = "<client_id>" client_secret = "<client_secret>" def home(request: HttpRequest) -> JsonResponse: return JsonResponse({ "msg": "Hello World" }) def peeringdb_login(request: HttpRequest): return redirect(redirect_url_peeringdb) def peeringdb_login_redirect(request: HttpRequest): code = request.GET.get('code') print("### 1 ### code: ", code) user = exchange_code(code) print("### 2 ### email: ", user) return JsonResponse({ "user": user}) def exchange_code(code: str): print("### 3 ### code: ", code) data = { "client_id": "<client_id>", "client_secret": "<client_secret>", "grant_type": "authorization_code", "code": code, "redirect_uri": "https://localhost:8000/oauth2/login/redirect", "scope": "email" } headers = { 'Content-Type': 'application/x-www-form-urlencoded' } response = requests.post("https://auth.peeringdb.com/oauth2/token/", data=data, headers=headers) print("### 4 ### response: ", response) print("### 5 ### response.json: ", response.json()) credentials = response.json() print("### 6 ### credentials: ", credentials) access_token = credentials['access_token'] print("### 7 ### access_token: ", access_token) response1 = requests.get("https://auth.peeringdb.com/profile/v1", headers={ "Authorization": "Bearer %s" % access_token }) print("### 8 ### response1: ", response1) print("### 9 ### response1: ", response1.json()) user = response1.json() print("### 10 ### user: ", user) i am getting error: 127.0.0.1 - - [26/Jun/2023 21:21:16] "GET /oauth2/login HTTP/1.1" 302 - ### 1 ### code: <code> ### 3 ### code: <code> ### 4 ### response: <Response [200]> ### 5 ### response.json: {'access_token': '<access_token>', 'expires_in': 36000, 'token_type': 'Bearer', 'scope': 'email', 'refresh_token': '<refresh_token>'} ### 6 ### credentials: {'access_token': '<access_token>', 'expires_in': 36000, 'token_type': 'Bearer', 'scope': 'email', 'refresh_token': '<refresh_token>'} ### 7 ### access_token: <access_token> ### 8 ### response1: <Response [403]> 127.0.0.1 - - [26/Jun/2023 21:21:17] "GET /oauth2/login/redirect?code=<code>&state=1234zyx HTTP/1.1" 500 - Traceback (most recent call last): File "/Users/miklab01/Library/Python/3.9/lib/python/site-packages/requests/models.py", line 971, in json return complexjson.loads(self.text, **kwargs) File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/json/__init__.py", line 346, in loads return _default_decoder.decode(s) File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/json/decoder.py", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.9/lib/python3.9/json/decoder.py", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) any one have idea where i am missing something? i think issue might be with the url i send and autorization... ? https://auth.peeringdb.com/profile/v1/

1 1

Problem with OAuth2 authentication
by Sergio Bellini - Webplease 23 Jun '23

23 Jun '23

I am writing about an OAuth2 authentication problem. I had created a platform that used your authentication as a second method, but a few months ago it suddenly stopped working. When I send a request to https://auth.peeringdb.com/oauth2/token I get this response: string(51) "{"meta": {"error": "Invalid username or password"}}" I checked the ClientID and ClientSecret but they haven't changed. What could have happened to your side? Thanks, Sergio Bellini

2 1

Re: [PDB Tech] OAuth client application help requested - cannot authorize with client secret
by Justin Cole 22 Feb '23

22 Feb '23

Thank you for the response Leo. I was able to get it working by excluding the authorization header and call like so: POST to https://auth.peeringdb.com/oauth2/token/<https://auth.peeringdb.com/oauth2/token/> Header: 'Content-Type': 'application/x-www-form-urlencoded' Body: 'grant_type=authorization_code&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&code=CODE&redirect_uri=CALLBACK_URI' It seems the system does not like the Basic auth header, nor does it like JSON as the request body. Hopefully this helps someone in the future. Thanks, Justin From: Leo Vegoda <leo(a)peeringdb.com> Sent: Wednesday, February 22, 2023 11:01 AM To: Justin Cole <justinc(a)redapt.com> Subject: Re: [PDB Tech] OAuth client application help requested - cannot authorize with client secret Hi Justin, 2.44.0 was just deployed to production. It included a fix for OAuth logins that failed when MFA was enabled. It's possible that this has resolved your issue. If not, please let us know. Release Notes<https://docs.peeringdb.com/release_notes/> docs.peeringdb.com<https://docs.peeringdb.com/release_notes/> [favicon.ico]<https://docs.peeringdb.com/release_notes/> Kind regards, Leo Vegoda PeeringDB Product Manager On Feb 15, 2023, at 19:52, Justin Cole <justinc(a)redapt.com<mailto:justinc@redapt.com>> wrote: Hello, I'm hoping someone can help me with my OAuth application problem. I have created an OAuth application with authorization-code grant type and entered my redirect uri. I can successfully call the /authorize/ endpoint, log in and receive an authorization code. However, the subsequent callback to /token/ always returns 401 Unauthorized with response body: { "meta": { "error": "Invalid username or password" } } Call to /token/ looks like: POST to https://auth.peeringdb.com/oauth2/token/<https://auth.peeringdb.com/oauth2/token/> Header: Authorization: Basic (Base64Encode(CLIENT_ID:CLIENT_SECRET)) Body: { grant_type:'authorization_code', code:'CODE', redirect_uri:'https://localhost:3001/api/auth/callback/peeringdb<https://localhost:3001/api/auth/callback/peeringdb>', client_id:'CLIENT_ID', client_secret:'CLIENT_SECRET' } I've determined that problem is the Authorization header value, however I've verified the values match the client id/client secret generated from PeeringDB (https://www.peeringdb.com/oauth2/applications/register/<https://www.peeringdb.com/oauth2/applications/register/>) are correct. What am I doing wrong? Or is there something I am missing to enable the OAuth application registration from working properly? Thank you, Justin _______________________________________________ Pdb-tech mailing list Pdb-tech(a)lists.peeringdb.com<mailto:Pdb-tech@lists.peeringdb.com> https://lists.peeringdb.com/cgi-bin/mailman/listinfo/pdb-tech<https://lists.peeringdb.com/cgi-bin/mailman/listinfo/pdb-tech>

1 0

OAuth client application help requested - cannot authorize with client secret
by Justin Cole 16 Feb '23

16 Feb '23

Hello, I'm hoping someone can help me with my OAuth application problem. I have created an OAuth application with authorization-code grant type and entered my redirect uri. I can successfully call the /authorize/ endpoint, log in and receive an authorization code. However, the subsequent callback to /token/ always returns 401 Unauthorized with response body: { "meta": { "error": "Invalid username or password" } } Call to /token/ looks like: POST to https://auth.peeringdb.com/oauth2/token/ Header: Authorization: Basic (Base64Encode(CLIENT_ID:CLIENT_SECRET)) Body: { grant_type:'authorization_code', code:'CODE', redirect_uri:'https://localhost:3001/api/auth/callback/peeringdb', client_id:'CLIENT_ID', client_secret:'CLIENT_SECRET' } I've determined that problem is the Authorization header value, however I've verified the values match the client id/client secret generated from PeeringDB (https://www.peeringdb.com/oauth2/applications/register/) are correct. What am I doing wrong? Or is there something I am missing to enable the OAuth application registration from working properly? Thank you, Justin

1 0

OAuth use for peering portal identification
by Paul Hoogsteder 24 Oct '22

24 Oct '22

Hello group, Is anyone aware of other peering portals than Cloudflare and Facebook's that use the PeeringDB OAuth system? Kind regards, Paul Hoogsteder (wearing many hats)

3 3

Re: [PDB Tech] OAuth use for peering portal identification
by Jeroen Massar 21 Oct '22

21 Oct '22

> On 21 Oct 2022, at 11:08, Paul Hoogsteder <paul(a)meanie.nl> wrote: > >> ï»¿ >>> On 21 Oct 2022, at 10:27, Paul Hoogsteder <paul(a)meanie.nl> wrote: >>> Hello group, >>> Is anyone aware of other peering portals than Cloudflare and Facebook's >>> that use the PeeringDB OAuth system? >> https://peeringmanager.com >> Is one of them. > > Does PeeringManager also provide a portal for *other networks* to request > sessions? I looked at PeeringManager for my hobby network AS31019, but > with thousands of sessions it's way too expensive for a network with zero > paying customers There is also: https://peering-manager.net which has a little cat link: https://github.com/peering-manager/peering-manager demo: https://ripe76.ripe.net/archives/video/13/ + https://ripe84.ripe.net/archives/video/790/ Naming these things is.... interesting, because dupes will exist for these things. Greets, Jeroen (But for both my NIH kicked in, they did not match my personal requirements... hence, once upon a time when I have time.... ;)

1 0

Re: [PDB Tech] OAuth use for peering portal identification
by Jeroen Massar 21 Oct '22

21 Oct '22

> On 21 Oct 2022, at 10:27, Paul Hoogsteder <paul(a)meanie.nl> wrote: > > Hello group, > > Is anyone aware of other peering portals than Cloudflare and Facebook's > that use the PeeringDB OAuth system? https://peeringmanager.com Is one of them. Greets, Jeroen

2 1