Unidata
OPeNDAP server works in netCDF-C 4.8.1 but fails in 4.9.2
NetCDF version - 4.9.2 OS: Debian 12 HDF5 version - 1.14.4.3
Hello,
A customer of MATLAB is running into some issues while trying to access an OPeNDAP link with authentication. We are trying to access an OPenDAP url using the netCDF-C library. The file needs authentication for access, which are contained in .dodsrc, .netrc and ursCookies files.
With these authentication files, the file can be accessed successfully in netCDF-C v4.8.1. But with netCDF-C v4.9.2, I see the following error:
“syntax error, unexpected WORD_WORD, expecting SCAN_ATTR or SCAN_DATASET or SCAN_ERROR
context: <!DOCTYPE^ HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>401 Unauthorized</title></head><body><h1>Unauthorized</h1><p>This server could not verify that youare authorized to access the documentrequested. Either you supplied the wrongcredentials (e.g., bad password), or yourbrowser doesn't understand how to supplythe credentials required.</p><hr><address>Apache Server at tds.aviso.altimetry.fr Port 80</address></body></html>
Error: NetCDF: Access failure”
The link the customer is trying to access is this: https://tds.aviso.altimetry.fr/thredds/dodsC/dataset-duacs-nrt-global-allsat-madt-fsle--DIRECT-FILES-ACCESS/2025/nrt_global_allsat_madt_fsle_20250115_20250121.nc
Here is the output from repro.cpp file using netCDF v4.8.1:
Successfully opened the file: https://tds.aviso.altimetry.fr/thredds/dodsC/dataset-duacs-nrt-global-allsat-madt-fsle--DIRECT-FILES-ACCESS/2025/nrt_global_allsat_madt_fsle_20250115_20250121.nc
Successfully closed the file: https://tds.aviso.altimetry.fr/thredds/dodsC/dataset-duacs-nrt-global-allsat-madt-fsle--DIRECT-FILES-ACCESS/2025/nrt_global_allsat_madt_fsle_20250115_20250121.nc
Here is the code:
#include <stdio.h>
#include <netcdf.h>
#define FILE_NAME "https://tds.aviso.altimetry.fr/thredds/dodsC/dataset-duacs-nrt-global-allsat-madt-fsle--DIRECT-FILES-ACCESS/2025/nrt_global_allsat_madt_fsle_20250115_20250121.nc"
int main() {
int ncid; // NetCDF file ID
int retval; // Return value for error handling
// Open the netCDF file in read-only mode
if ((retval = nc_open(FILE_NAME, NC_NOWRITE, &ncid))) {
fprintf(stderr, "Error: %s\n", nc_strerror(retval));
return retval;
}
printf("Successfully opened the file: %s\n", FILE_NAME);
// Close the netCDF file
if ((retval = nc_close(ncid))) {
fprintf(stderr, "Error: %s\n", nc_strerror(retval));
return retval;
}
printf("Successfully closed the file: %s\n", FILE_NAME);
return 0;
}
I believe so. But I do not know enough about authentication to confirm this. How do I find out the source of authentication? For authentication, the following files are used - .dodsrc, .netrc and ursCookies
It looks like aviso has its own authentication. I have applied for access; one hopes it will be granted,
Hi @DennisHeimbigner
We seem to have run into a similar issue with a different file: https://opendap.earthdata.nasa.gov/collections/C3309442935-POCLOUD/granules/NASA-SSH_alt_ref_simple_grid_v1_19921102#dap4
It needs authentication, and I have the .netrc and .dodsrc set up as needed (.netrc containing my EarthData credentials, and .dodsrc pointing to .netrc and the cookie file).
Using 4.8.1 the same reproduction code above with this new URL works fine:
Successfully opened the file: https://opendap.earthdata.nasa.gov/collections/C3309442935-POCLOUD/granules/NASA-SSH_alt_ref_simple_grid_v1_19921102#dap4
Successfully closed the file: https://opendap.earthdata.nasa.gov/collections/C3309442935-POCLOUD/granules/NASA-SSH_alt_ref_simple_grid_v1_19921102#dap4
On the same machine with the same .netrc and .dodsrc, but using 4.9.2, I get:
Error: NetCDF: Access failure
When using CURLOPT_VERBOSE=1, I see this in the output - so it looks like 4.9.2 has trouble picking the credentials from .netrc file.
<...>
< HTTP/1.1 401 Unauthorized
< Server: nginx/1.22.1
< Date: Wed, 09 Jul 2025 15:56:40 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Frame-Options: SAMEORIGIN
< X-XSS-Protection: 0
< X-Content-Type-Options: nosniff
< X-Permitted-Cross-Domain-Policies: none
< Referrer-Policy: strict-origin-when-cross-origin
< Cache-Control: no-store
< Pragma: no-cache
< Expires: Fri, 01 Jan 1990 00:00:00 GMT
< WWW-Authenticate: Basic realm="Please enter your Earthdata Login credentials. If you do not have a Earthdata Login, create one at https://urs.earthdata.nasa.gov//users/new"
< X-Request-Id: 521fa746-e985-4571-add2-e1d2bffc032a
< X-Runtime: 0.008747
< Strict-Transport-Security: max-age=31536000
<
* Connection #1 to host urs.earthdata.nasa.gov left intact
Would appreciate any pointers! Is this reproducible on your end and are there any known similar issues?
Thanks, Kris
I believe the netrc authentication problems should be solved with libnetcdf 4.9.3, however, there seem to be problems building this for conda: https://github.com/conda-forge/libnetcdf-feedstock/pull/205
If memory serves, .netrc is read and used by libcurl. The only role of libnetcdf is to read the .netrc path from .ncrc/.dodsrc and pass it to libcurl. Can you say what version of libcurl you are using?