/
Run the Apply-Orbit-File operator from GPT behind a proxy with authentication

Run the Apply-Orbit-File operator from GPT behind a proxy with authentication

This guide describes a workaround for running the Apply-Orbit-File operator from GPT on Windows systems where the internet access is routed through a proxy that requires authentication.

The Apply-Orbit-File operator downloads orbit files from ESA’s public server to process products. When the user uses a machine which is not directly connected to the internet, a proxy server and port must be configured for each application that requires internet access.

Since GPT uses native JVM networking libraries which do not support proxy authentication, it can only connect to the internet through a proxy without authentication.

To bypass this limitation, you can configure a local proxy using 3rd party software. The local proxy authenticates with the upstream proxy and exposes a non-authenticated proxy endpoint for GPT to use.

This workaround can be used until an official solution is integrated into a future SNAP update.

Table of contents

The steps to apply this workaround on the Windows systems:

  1. Install the WinGate application with a free license for 10 concurrent user

image-20251112-115658.png

  • Click Next.

image-20251112-115802.png

  • Select the 1st option and then click Next.

image-20251112-120050.png

  • Choose the installation directory and then click Next.

image-20251112-120119.png

  • Uncheck the last option - WinGate Network Driver - and then click Next.

image-20251112-120150.png

  • Provide the email address for the administrative alerts and the email address of the sender and then click Next.

image-20251112-120310.png

  • Click Next to start the installation of the WinGate application.

image-20251112-120342.png

  • Click Next to finish the installation.

  1. Perform the initial setup of the WinGate application

image-20251112-120444.png

  • Open Start, type wingate and click on the WinGate Management application.

image-20251112-120541.png

  • Click on the localhost square.

image-20251112-120602.png
image-20251112-120937.png

  • If the machine has direct internet access, select the Online option. If a proxy without authentication is required to access the internet, check “Use proxy server to connect to the Internet”. Otherwise, select the Off-line option. Click OK.

image-20251112-121248.png

  • Select the 3rd option - Activate a free license - then click Next.

image-20251112-121426.png

  • Click on Make request button to save the License Request file localy. The WinGate application saves the file with the name License Request.req. Transfer this file to a machine with internet access.

image-20251112-123954.png

  • On a computer with internet access, upload the License Request.req on the Activation Website: http://activation.qbik.com. The license file will be automatically downloaded from the Activation Website.

image-20251112-124117.png

  • Transfer the downloaded file back to the offline machine to activate the WinGate application free license.

image-20251112-124154.png

  • In WinGate, click on Import activation file, select the new license file, then click Finish.

image-20251112-124224.png

  • WinGate needs to be restarted after the license is successfully activated.

image-20251112-124252.png

  • Click on Next to start the setup of WinGate database provider.

image-20251112-124313.png

  • Select the 3rd option - WinGate user database engine - from the dropdown menu and the click Next.

image-20251112-124630.png

  • Click Finish to finish the setup of WinGate database engine.

image-20251112-124704.png

  • Click OK to restart the WinGate application.

  1. Configure the Local Proxy in WinGate

image-20251112-124831.png

  • After the WinGate application was restarted, click on the localhost square.

image-20251112-124849.png

  • Select the Use another account option.

image-20251112-130307.png

  • Enter the username Administrator, leave the password blank and then click OK.

image-20251112-130433.png

  • The WinGate dashboard opens, and the application displays a notification requiring user attention. Click the Go to notifications link in the yellow banner at the top.

image-20251112-130500.png

  • The 1st notification about WinGate Updates can be ignored because the application is not yet configured to access the internet through the upstream proxy.

  • The 2nd notification about WinGate DNS client configuration can be fixed by the following steps:

→ In the left Navigation panel, click on Control Panel → DNS Client to open the DNS Client window

image-20251112-131556.png

→ Click on the Add new server button from the group of 4 buttons (1st button).

image-20251112-131627.png

→ Enter the desired DNS server IP address, e.g. 8.8.8.8, check the Use server for internet lookups checkbox and then click OK.

image-20251112-131716.png

→ Click OK on the DNS Client window.

image-20251112-131841.png

  • The WinGate application is now ready. Click the second link, Install / configure services, to configure the local proxy that connects to the upstream proxy requiring authentication.

image-20251112-132155.png

  • Double click on WWW Proxy Server service to open the properties window

image-20251112-132245.png

  • In the General tab, you can optionally change the local proxy server port to any port that is not being used by another application. The default port is 80.

image-20251112-132326.png

  • In the Connection tab, check Connect via upstream proxy, then enter the IP address / domain of the upstream proxy, the port, select the Proxy type, check Proxy requires authentication and enter the credentials. Then click OK.

  1. Check that the local proxy is working and that the internet can be accessed without entering the authentication credentials.

image-20251112-132455.png

  • Open the Windows network settings, select Proxy, enter the local proxy IP address

    127.0.0.1

    and the local proxy port 80(default), then click Save.

  • Open a browser and access any website. If the page loads without prompting for proxy authentication credentials, the workaround is working.

image-20251112-132530.png

  1. Verify the Workaround with SNAP GPT

  • Open the gpt.vmoptions file located in <SNAP_INSTALL_DIR>\bin directory:

image-20251112-132600.png

  • Add the following lines to configure the local proxy IP and port:

-Dhttp.proxyHost=127.0.0.1 -Dhttp.proxyPort=80

  • Save the file.

  • Open the Command prompt window in the bin directory of SNAP Desktop, then run the Apply-Orbit-File GPT operator with the command:

gpt.exe Apply-Orbit-File {S1_product_directory}\manifest.safe -t {output_directory}\target.dim

  • If the output looks like this, the workaround is not functioning in the user’s environment, or an error occurred during setup. Please review the configuration.

image-20251112-132859.png

  • If the output looks like this, the workaround is working in the user environment. Congratulations!

image-20251112-132915.png

The steps to apply this workaround on the Linux systems:

  1. Install the SQUID application which is licensed under the GPL

a) To be able to download the updates and the software packages using apt, through a proxy with authentication, a special configuration is needed.
If the system is already configured, skip to the step b)

image-20251117-143905.png

  • Edit the apt configuration file, by entering the following command in the terminal:

    sudo nano /etc/apt/apt.conf
image-20251117-144354.png

  • Enter the following special line:

Acquire::http::proxy “http://<username>:<password>@<ip>:<port>/”;

,then press CTRL + O for saving the changes and CTRL + X to exit the nano.

image-20251117-144748.png

  • Check for updates of Ubuntu operating system by entering the following command:

    sudo apt update

If the output is like this, the apt is correctly configured to pass the proxy with authentication, else please check the connection with the proxy server and the provided authentication credentials are correct.

image-20251117-144942.png

b) install the SQUID application

  • Install of the squid local proxy application by entering the following command in the terminal:

    sudo apt install squid
image-20251117-145216.png

  • Enter Y to confirm the installation

  1. Configure the Local Proxy in SQUID

image-20251117-145426.png

  • Backup the original configuration file of squid application, before entering the custom configuration for this workaround, by entering the following command in the terminal:

    sudo mv/etc/squid/squid.conf /etc/squid/squid.conf.bak
image-20251117-145538.png

  • Edit the squid configuration file by entering the following command in the terminal:

    sudo nano /etc/squid/squid.conf
image-20251117-145640.png

  • Enter the following lines in the squid.conf file:

cache_peer <upstream_proxy_ip> parent <upstream_proxy_port> 0 no-query default login=<username>:<password> never_direct allow all always_direct deny all http_port <local_proxy_port> acl localhost src 127.0.0.1 http_access allow localhost http_access deny all dns_nameservers 8.8.8.8

then, press CTRL + O to save the changes and CTRL + X to exit the nano.

image-20251117-145843.png

  • Restart the squid service by entering the following command in the terminal:

    sudo systemctl restart squid

  1. Check that the local proxy is working and that the internet can be accessed without entering the authentication credentials.

a) Check using a terminal program like curl.

image-20251117-150117.png

  • Open a connection with an internet website using curl by entering the following command in the terminal:

    curl -x 127.0.0.1:<local_proxy_port> http://step.esa.int
image-20251117-162246.png

  • If the output looks like this, the curl application is not installed.
    Install the curl application by entering the following command in the terminal:

    sudo apt install curl
image-20251117-162506.png

  • Open a connection with an internet website using the curl by entering the following command in the terminal:

    curl -x 127.0.0.1:<local_proxy_port> http://step.esa.int
image-20251117-162658.png

  • If the output looks like this, the local proxy is working and passing the requests through the upstream proxy which requires authentication, else please check the connection with the upstream proxy server and the authentication credentials provided in the squid configuration file are correct.

b) check using the browser

image-20251117-163011.png

  • Open the network settings of Ubuntu, toggle Network Proxy, enter the local proxy IP address

    127.0.0.1

    and the local proxy port set on the squid configuration file, then click on Save

image-20251117-163234.png

  • Open the browser then browse to a website from the internet. If it loads without requesting the proxy authentication credentials, the workaround is ready.

  1. Verify the Workaround with SNAP GPT

image-20251117-163544.png

  • Open the gpt.vmoptions from the bin directory of the SNAP Desktop then, enter the local proxy IP by

    -Dhttp.proxyHost=127.0.0.1

    and the local proxy port by

    -Dhttp.proxyPort=<local_proxy_port>

    then, Save the file.

image-20251117-194258.png

  • Open the console window at the bin directory of the SNAP Desktop then run the Apply-Orbit-File GPT operator by entering the following command in the terminal:

    ./gpt Apply-Orbit-File {S1_product_zip_file} -t {output_directory}/target.dim
image-20251117-194611.png

  • If the output looks like this, the workaround is not functioning in the user’s environment, or an error occurred during setup. Please review the configuration.

image-20251117-194633.png

  • If the output looks like this, the workaround is working in the user environment. Congratulations!