0

I am having issues with implementing a custom AutoML model in a .NET web app that allows sending images via the REST API to be recognized. I keep getting errors.

The remote server returned an error: (403) Forbidden.

I have an image and converted it into a string of bytes called imageBytesString and have created the jsonRequest object like this:

string jsonRequest = "{\"payload\":{\"image\":{\"imageBytes\":\"" + imageBytesString + "\"},}}";`

Then I'm doing a POST request like follows:

WebRequest request = WebRequest.Create(@"https://automl.googleapis.com/v1beta1/projects/PROJECT_ID/locations/us-central1/models/MODEL_ID:predict");
request.Method = "POST";
request.ContentType = "application/json";
request.Headers.Add("Authorization", "Bearer GCLOUD_ACCESS_TOKEN");

using (var streamWriter = new StreamWriter(request.GetRequestStream()))
{
    streamWriter.Write(jsonRequest);
}

Then when it hits request.GetResponse(); if gives me the above error with no other information.

For reference, these are the snippets taken from the bottom of the PREDICT page on my custom AutoML model:

request.json:

{
  "payload": {
    "image": {
      "imageBytes": "YOUR_IMAGE_BYTE"
    },
  }
}

Execute the request:

curl -X POST -H "Content-Type: application/json" \
  -H "Authorization: Bearer $(gcloud auth application-default print-access-token)" \
  https://automl.googleapis.com/v1beta1/projects/PROJECT_ID/locations/us-central1/models/MODEL_ID:predict -d @request.json

Thanks

Lefteris S
  • 1,614
  • 1
  • 7
  • 14
user3636407
  • 103
  • 1
  • 10

3 Answers3

1

The curl request you reference passes an access token in the header using the gcloud auth application-default print-access-token command. This produces a new token every time it is ran. The token has an expiration time, typically 3600 seconds. You can check that yourself by running: curl https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=GCLOUD_ACCESS_TOKEN. This will return a payload including a "expires_in" field. So, passing the token as a GCLOUD_ACCESS_TOKEN environment variable will result in a 403 error after it expires. What you should do instead is create a service account with the correct permissions, download a json with its credentials and set GOOGLE_APPLICATION_CREDENTIALS to the json's path. Check here under Download credentials for an example in .NET.

Lefteris S
  • 1,614
  • 1
  • 7
  • 14
  • It is documented at https://cloud.google.com/vision/automl/docs/tutorial#configure_your_project_environment – bao Aug 13 '18 at 16:55
  • I already have set up the service account and am setting the `GOOGLE_APPLICATION_CREDENTIALS` environment variable as you mentioned. If I don't include the `GCLOUD_ACCESS_TOKEN`, I get a "(401) Unauthorized" error. I get the same error after the token expires. I have to get a new access token from the shell console and replace the one in the header with the new one. Then it goes back to the "(403) Forbidden" error. – user3636407 Aug 15 '18 at 02:04
  • What if you unset `GOOGLE_APPLICATION_CREDENTIALS`, try `gcloud auth application-default login` and then run the `curl` command? This should help isolate the issue. – Lefteris S Aug 15 '18 at 07:50
1

I was finally able to get it working.

There were 2 issues that needed to be fixed for it to work.

Firstly; for some reason, when I initially created the service account and entered the command gcloud auth activate-service-account --key-file="[/PATH/TO/KEY/FILE.json], it told me that it worked and the service account was added to the gcloud auth list list. But upon checking again, it wasn't there so I ran it again.

Secondly; I was getting the access token with the following command:

gcloud auth application-default print-access-token

Instead, I tried using the access token received with the following command:

gcloud auth print-access-token

(Without application-default) in there.

After I had done both those things, I am now able to successfully send an image request and receive the prediction response.

But it seems I still have to get a new access token every hour though... But that's another issue I suppose.

user3636407
  • 103
  • 1
  • 10
1

A better solution is to access the Auto ML endpoint only from within the same project (then you won't need access tokens).

To access the endpoint from outside of the project, use an API gateway such as APIGEE or AppEngine -- those give you much better controls

Lak
  • 3,876
  • 20
  • 34
  • What do you mean "Access the Auto ML endpoint only from within the same project"? Can you elaborate on that? Or point me in the direction of any documentation to do that? – user3636407 Aug 26 '18 at 14:55
  • Access it from a compute engine instance, appengengine instance etc. In the same project. Then you don't need service keys. See the flowchart in https://cloud.google.com/iam/docs/understanding-service-accounts – Lak Aug 27 '18 at 15:40