<html><head><meta http-equiv="content-type" content="text/html; charset=us-ascii"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On 18 Nov 2024, at 15:17, Mark Taylor <m.b.taylor@bristol.ac.uk> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div><blockquote type="cite" style="font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><blockquote type="cite">- You might authenticate to make a TAP query, get a DataLink file,<br> and save it for later use. When you re-load it the next day,<span class="Apple-converted-space"> </span><br> your application no longer has the same authentication context,<span class="Apple-converted-space"> </span><br> and attempting to follow access_urls in the DataLink table will<span class="Apple-converted-space"> </span><br> give you 401s. You don't know which registered service is<br> associated with the authentication required, but challenges<br> in the 401 headers can tell you how to authenticate.<br><br></blockquote>This is a more compelling reason on the face of it, but if you accept my initial premise that services should not be handing out datalink references to protected URLs outside their security domain, then this can also be solved by the datalink response containing the ivorn of the service that produced the datalink response.<br></blockquote><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Where? As it stands the DataLink response table has no column</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">for such an ivorn.</span><br style="caret-color: rgb(0, 0, 0); font-family: Monaco; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"></div></div></blockquote></div><br><div>If the mechanism does not exist yet it could be added, but the service self description <a href="https://www.ivoa.net/documents/DataLink/20231215/REC-DataLink-1.1.html#tth_sEc4.4">https://www.ivoa.net/documents/DataLink/20231215/REC-DataLink-1.1.html#tth_sEc4.4</a> would seem to be the place. The example shown does not have the IVORN as a parameter, but presumably it could. There is a bit of text in that section that says that the {links} capability is not registered (not entirely sure why, but I have felt for a while that datalink has not been able to decide if it is a service or just a response format), however, there could be an IVORN to the originating TAP service.</div><div><br></div><div>Paul.</div></body></html>