# PAT settings **URL:** \ **Category:** Documentation\ **Created:** [23 March 2023 07:00 UTC](https://community.openbis.ch/t/pat-settings/150 "2023-03-23T07:00:09Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [23 March 2023 07:00 UTC](https://community.openbis.ch/t/pat-settings/150/1 "2023-03-23T07:00:09Z")
Dear all, I’m trying to change the max. time a PAT is valid. Following the documentation: [Personal Access Tokens - openBIS Documentation Rel. 20.10 - Confluence](https://unlimited.ethz.ch/display/openBISDoc2010/Personal+Access+Tokens) do I understand correctly, that the file referred to by: “To configure it please use AS service.properties:” is `openbis/servers/openBIS-server/jetty/etc/service.properties` Since the configuration files also contain many options that are commented out (but this allows us to find them easily) - but this is not one of them, I just wanted to double-check if the lines should be added here: ```auto # personal access tokens feature personal-access-tokens-enabled = true # change the default location of the JSON file that stores personal access tokens (default: personal-access-tokens.json file in the main openBIS folder) personal-access-tokens-file-path = MY_FOLDER/personal-access-tokens.json # set maximum allowed validity period (in seconds) - personal access token with a longer validity period cannot be created (default: 30 days) personal-access-tokens-max-validity-period = 2592000 # set validity warning period (in seconds) - owners of personal access tokens that are going to expire within this warning period are going to receive email notifications (default: 5 days) personal-access-tokens-validity-warning-period = 259200 ``` many thanks Ulrich ---
**Author:** ![cbarillari](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/cbarillari/32/10_2.png) [@cbarillari](https://community.openbis.ch/u/cbarillari)\ **Post date:** [29 March 2023 07:27 UTC](https://community.openbis.ch/t/pat-settings/150/2 "2023-03-29T07:27:31Z")
Dear Ulrich, this is the correct file. ---
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [13 April 2023 15:26 UTC](https://community.openbis.ch/t/pat-settings/150/3 "2023-04-13T15:26:04Z")
Dear Caterina, many thanks - using the PAT seems to work, however, I do get an error message if I follow the steps on the pyBIS documentation? ```auto pat_name = os.environ['OPENBISPAT'] pat = oBis.get_or_create_personal_access_token(sessionName=pat_name) oBis.set_token(pat, save_token=True) ``` results in ```auto /home/kerzel/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/things.py:240: FutureWarning: iteritems is deprecated and will be removed in a future version. Use .items instead. ].iteritems(): Output exceeds the size limit. Open the full output data in a text editor--------------------------------------------------------------------------- TypeError Traceback (most recent call last) Cell In[8], line 6 4 pat_name = os.environ['OPENBISPAT'] 5 pat = oBis.get_or_create_personal_access_token(sessionName=pat_name) ----> 6 oBis.set_token(pat, save_token=True) File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:4389, in Openbis.set_token(self, token, save_token) 4387 if not token: 4388 return -> 4389 if not self.is_token_valid(token): 4390 raise ValueError("Session is no longer valid. Please log in again.") 4391 else: File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:4365, in Openbis.is_token_valid(self, token) 4359 return False 4361 request = { 4362 "method": "isSessionActive", 4363 "params": [token], 4364 } -> 4365 resp = self._post_request(self.as_v3, request) 4366 return resp File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:1234, in Openbis._post_request(self, resource, request) 1230 def _post_request(self, resource, request): ... 178 """ --> 179 raise TypeError(f'Object of type {o. __class__. __name__ } ' 180 f'is not JSON serializable') TypeError: Object of type PersonalAccessToken is not JSON serializable ``` Many thanks Ulrich ---
**Author:** ![cbarillari](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/cbarillari/32/10_2.png) [@cbarillari](https://community.openbis.ch/u/cbarillari)\ **Post date:** [17 April 2023 16:47 UTC](https://community.openbis.ch/t/pat-settings/150/4 "2023-04-17T16:47:36Z")
Dear Ulrich, The documentation is not correct. The correct way to do this currently is: pat = o.get\_or\_create\_personal\_access\_token(sessionName=“Project A”) o.set\_token(pat.permId, save\_token=True) In the next pyBIS version both ways to set the tokens will be accepted. ---
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [12 May 2023 15:26 UTC](https://community.openbis.ch/t/pat-settings/150/5 "2023-05-12T15:26:11Z")
Dear @cbarillari, many thanks and apologies for the slow reply. Hm, I guess maybe I misunderstand something about the PAT… I had, perhaps naively, assumed that I can refer to the PAT via the associated session name (as a short name) however, when I do: ```auto oBis = Openbis(server_url, verify_certificates=True) pat = oBis.get_or_create_personal_access_token(sessionName=session_name) ``` I get the error message: ```auto --------------------------------------------------------------------------- AttributeError Traceback (most recent call last) Cell In[7], line 5 1 ## 2 ## create connection to openBIS server 3 ## 4 oBis = Openbis(server_url, verify_certificates=True) ----> 5 pat = oBis.get_or_create_personal_access_token(sessionName=session_name) File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:1983, in Openbis.get_or_create_personal_access_token(self, sessionName, validFrom, validTo, force) 1981 session_token = self.token 1982 if not is_session_token(session_token): -> 1983 session_token = self.session_token 1984 if not session_token: 1985 session_token = get_token_for_hostname( 1986 self.hostname, session_token_needed=True 1987 ) AttributeError: 'Openbis' object has no attribute 'session_token' ``` which, perhaps, isn’t too surprising as I haven’t logged in with a session token or the long PAT value with $pat-… However, I thought (maybe naively) that I could use the short `session_name` instead? All the best Ulrich ---
**Author:** ![juanf](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/juanf/32/18_2.png) [@juanf](https://community.openbis.ch/u/juanf)\ **Post date:** [22 May 2023 17:30 UTC](https://community.openbis.ch/t/pat-settings/150/6 "2023-05-22T17:30:51Z")
Dear Ulrich, After creating the Openbis object you need to set the session\_token. For this you have several options: 1. Login using API. 2. Get the PAT after login and then set it. 3. Set session\_token property with a valid session token or PAT. There is no magic around it. Best, Juan ---
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [23 May 2023 05:10 UTC](https://community.openbis.ch/t/pat-settings/150/7 "2023-05-23T05:10:42Z")
Dear Juan, many thanks - I think that was due to my (mis-)understanding of the relationship between session\_token at PAT, in particular that one cannot create a PAT from a PAT. Best wishes Ulrich ---
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [25 October 2023 06:58 UTC](https://community.openbis.ch/t/pat-settings/150/8 "2023-10-25T06:58:32Z")
Dear Caterina, many thanks - we’ve recently upgraded to pyBIS 1.36.3, openBIS 20.10.7.1. I tried to come back to PAT, but I’m stuck (again or still…) Could you kindly take another look? When I log in with a session\_token, I can create the PAT: ```auto pat_name = 'PAT_20231024_T01' pat = oBis.get_or_create_personal_access_token(sessionName=pat_name) oBis.set_token(pat, save_token=True) ``` It also gets created: ```auto attribute value ---------------- ------------------------------------------------------------------ permId $pat-ulrichkerzel-2... sessionName PAT_20231024_T01 validFromDate 2023-10-24 09:26:17 validToDate 2023-11-23 08:26:17 accessDate 2023-10-25 07:44:16 owner ulrichkerzel registrator ulrichkerzel registrationDate 2023-10-24 09:26:46 modifier ulrichkerzel modificationDate 2023-10-24 09:26:46 ``` which is the same information as in `personal-access-tokens.json`. But then when I try to use it: ```auto oBis = Openbis(server_url, verify_certificates=False) pat = oBis.get_or_create_personal_access_token(sessionName='PAT_20231024_T01') ``` I get the following exception: ```auto {"method": "createPersonalAccessTokens", "params": ["$pat-ulrichkerzel-2", {"@type": "as.dto.pat.create.PersonalAccessTokenCreation", "sessionName": "PAT_20231024_T01", "validFromDate": 1698213754425, "validToDate": 1703402107466}], "id": "2", "jsonrpc": "2.0"} --------------------------------------------------------------------------- ValueError Traceback (most recent call last) File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:2043, in Openbis.get_or_create_personal_access_token(self, sessionName, validFrom, validTo, force) 2042 try: -> 2043 resp = self._post_request(self.as_v3, request) 2044 except ValueError as exc: File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:1249, in Openbis._post_request(self, resource, request) 1246 """internal method, used to handle all post requests and serializing / deserializing 1247 data 1248 """ -> 1249 return self._post_request_full_url(urljoin(self.url, resource), request) File ~/.cache/pypoetry/virtualenvs/openbis-qARisZC2-py3.10/lib/python3.10/site-packages/pybis/pybis.py:1296, in Openbis._post_request_full_url(self, full_url, request) 1295 print(json.dumps(request)) -> 1296 raise ValueError(resp["error"]["message"]) 1297 elif "result" in resp: ValueError: Personal access tokens cannot be used to manage personal access tokens. During handling of the above exception, another exception occurred: NotImplementedError Traceback (most recent call last) /home/kerzel/Repositories/openbis/openbis/test_pat.ipynb Cell 3 line 5 1 ## ... 2047 ) 2048 try: 2049 return self.get_personal_access_token(resp[0]["permId"]) NotImplementedError: Your openBIS instance does not support personal access tokens. Please upgrade your server and activate them. ``` Admittedly, I’m a bit confused. When I log in via the session ID, there is a PAT (also in the json), the first part of the output (with the `method`) also seems to return the PAT as it’s in the `params` - but there is still an exception? Any help would be greatly appreciated, many thanks Ulrich ---
**Author:** ![kerzel](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/kerzel/32/30_2.png) [@kerzel](https://community.openbis.ch/u/kerzel)\ **Post date:** [25 October 2023 07:08 UTC](https://community.openbis.ch/t/pat-settings/150/9 "2023-10-25T07:08:29Z")
As an addendum, it seems to work if I use `oBis.set_token(pat-permID)` directly, i.e. without using the session name to get the permID of the PAT. I had, perhaps naively assumed that I can use the session name for the PAT to retrieve the permID of the PAT, i.e. I don’t have to store or remember the permID of the PAT but only the session name? Many thanks Ulrich ---
**Author:** ![piotr.kupczyk](https://avatars.discourse-cdn.com/v4/letter/p/97f17d/32.png) [@piotr.kupczyk](https://community.openbis.ch/u/piotr.kupczyk)\ **Post date:** [26 October 2023 09:33 UTC](https://community.openbis.ch/t/pat-settings/150/10 "2023-10-26T09:33:51Z")
Dear Ulrich, For security reasons, using a personal access token to create a new personal access token is not allowed (only regular sessions can create new personal access tokens). The exception you are getting is thrown exactly because of this limitation (see “Personal access tokens cannot be used to manage personal access tokens.” error message). In order to call “get\_or\_create\_personal\_access\_token” method you need to use a regular session token (not a PAT). All the best, Piotr ---
**Author:** ![relathman](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@relathman](https://community.openbis.ch/u/relathman)\ **Post date:** [27 November 2023 14:34 UTC](https://community.openbis.ch/t/pat-settings/150/11 "2023-11-27T14:34:45Z")
We recently got a request/suggestions from one of our users that it would be great to create “read-only” PATs with limited rights (e.g., only Obersever rights) in order to create automated analysis workflows that should not be able to edit anything in openBIS (as a safeguard). @piotr.kupczyk and @juanf: Is that something that you could envision for the a future version of openBIS/pyBIS? ---
**Author:** ![juanf](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/juanf/32/18_2.png) [@juanf](https://community.openbis.ch/u/juanf)\ **Post date:** [28 November 2023 14:08 UTC](https://community.openbis.ch/t/pat-settings/150/12 "2023-11-28T14:08:05Z")
An admin could already create an Observer user and create a PAT for him, then use that in your pipeline. But yeah, standard users cannot do that, what adds to the administrative burden. ---
**Author:** ![bafe](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bafe](https://community.openbis.ch/u/bafe)\ **Post date:** [28 November 2023 15:16 UTC](https://community.openbis.ch/t/pat-settings/150/13 "2023-11-28T15:16:56Z")
@juanf Would it help to offer the users the options to create fine-grained PATs? This is e.g how Github and Gitlab solve the creation of PATs: users can select what rights to assign to different PATs, as well as the scope of a PAT, e.g a specific space or project. ---
**Author:** ![juanf](https://dub1.discourse-cdn.com/flex013/user_avatar/community.openbis.ch/juanf/32/18_2.png) [@juanf](https://community.openbis.ch/u/juanf)\ **Post date:** [29 November 2023 08:52 UTC](https://community.openbis.ch/t/pat-settings/150/14 "2023-11-29T08:52:11Z")
It would help, but it would mean an extension to the rights management system since users would need to be able to create a virtual account under them with as many rights or less than them. The amount of effort needed to make it happen is considerable, so probably not for the next mayor version. I would suggest for now request your admin to create such accounts for you ---
**Author:** ![relathman](https://avatars.discourse-cdn.com/v4/letter/r/439d5e/32.png) [@relathman](https://community.openbis.ch/u/relathman)\ **Post date:** [29 November 2023 09:49 UTC](https://community.openbis.ch/t/pat-settings/150/15 "2023-11-29T09:49:10Z")
Thanks a lot for the quick feedback and explanation! We use our LDAP service for user management (including group affiliation), so creating extra users isn’t really an option which is why we would prefer another solution. ---
**Author:** ![bafe](https://avatars.discourse-cdn.com/v4/letter/b/9de053/32.png) [@bafe](https://community.openbis.ch/u/bafe)\ **Post date:** [1 December 2023 08:38 UTC](https://community.openbis.ch/t/pat-settings/150/16 "2023-12-01T08:38:45Z")
> [@juanf](#): > > It would help, but it would mean an extension to the rights management system since users would need to be able to create a virtual account under them with as many rights or less than them. I understand this requires more effort, but long-term it seems the best way to reduce the administrative burden. I’d consider this solution as it would solve many related problems