error code for non-auth with wildcards

[crotwell]

Spec says:

In the case that the user is not allowed to access a
dataset, the same error codes as in the “queryauth” method should be used (401:
unauthorized, 403: forbidden access).

Would be helpful to clarify how this works in the case of wildcard requests with some matching data is not allowed access, but some is. I think the existing services treat a wildcard request as if the restricted data did not exist, and so no error code is returned.

Concrete example would be the station web service where the user requests all stations within a lat,lon box that includes some restricted stations and some non-restricted stations. To return an error message in this case seems wrong, and it would be better to return the non-restricted stations as if the restricted ones did not exist.

[jschaeff]

This is more an issue in the dataselect specification I would say.
The behaviour is not specified so each implementation could vary.

Having said that, the behaviour you describe (ignoring unauthorized data, handing over authorized data) seems natural, although the end user has no mean to verify that the data returned is complete or incomplete (this could be checked with availability though).

I feel like 403 should be preferred over 401 , but at the end it could also be a 404 "no data", because no authorized data can be retrieved ... In the end, it's more a problem of the dataselect spec 😱

Maybe, in the scope of the AAI standard, we should specify that the response should comply to the queryauth behaviour, without adding any example, because:

• we acknowledge that there are different behaviours out there
• the ws standard could change in the future and fix this fuzziness

[rcasey-earthscope]

I agree with these observations, and this relates to issue #5 . Now, the question should be, is such a discussion in scope for this specific proposal?

[javiquinte]

I also agree. This is a well known problem from the original specification of FDSN WS in general. There is only one error code that cannot express what actually happened during the request. For instance, requesting (meta)data from 2 stations and receive from only 1, would return a 200 OK. But you don't know if the data from the 2nd station does not exist (potential 204), or if there was an error during retrieval. As Rob suggested, I think this is beyond the scope of this proposal.

[crotwell]

I've added an issue on fdsnws-dataselect for this, hopefully can be clarified on a future revision.