bazelbuild / bazelbuild/reclient

Getting error when using credential helper: "externally provided auth token was invalid"

Open
#37 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
114
Forks
25
PR merge metrics
No merged PRs in 30d

Description

Hi guys, I'm trying to use reclient with buildbarn. My authentication method uses a custom credential helper, in my case it was just echo hard coded json like this:
```
{
"token": "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJhZG1pbiIsImFjY2Vzc190b2tlbiI6InRlc3RfYnVpbGRiYXJuIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cGlyZXNfaW4iOjB9.Buen5gwvRe5daKqajuscm-NK2hQ-zt3s9wQC_SXe_oeSVxmQCe-Hl0R99U5OxMX6xBitBcIVi6rcW1QKm81VTAWGdkLxY6BBBy9zElBd3otG3wb8AX7Zmjt5xz5zzbP0I0ocVye8w9OAR_wOiJ4ShQdhpfUXjeRgFgEw0H7cEbp-Fo6mydIMmkVGEH1USvxK-hlynfZ1X_y4AemQgN5YcyLAQ3apGTDll14-83RcWSlQ8z5NGqwNLpmuObNP9VHZ8fo6zIGNDwEcQV2WGMafx3JTsci6v4LgpAbuqyZeYq6PPoiubOPYoBL1svYsnjHXfWgJ5YKtimmCOLDm2SQOaA",
"expiry":"Sat Mar 15 14:21:16 CET 2024",
"refresh_expiry":"Sat Mar 15 14:21:16 CET 2024"
}
```
I was able to authenticate with my builbarn server using above token (send a `GetCapabilities `request via postman grpc) but reclient complain with error `Command failed: rpc error: code = Unauthenticated desc = Unable to authenticate with RBE, externally provided auth token was invalid`

This is a part in reproxy.Info log showing that the call to GetCapabilities fails
```
I0314 15:18:47.055880 11928 depsscannerclient.go:184] Connected to dependency scanner service on 127.0.0.1:58654
I0314 15:18:47.055978 11928 main.go:342] Finished setting up input processor
I0314 15:18:47.055978 11928 server.go:218] Startup status: Input Processor started? true, RBE connected (or disabled)? false, Startup error? false
I0314 15:18:47.639044 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:47.857893 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.130595 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.474757 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.802904 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:49.435857 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
E0314 15:18:49.435857 11928 main.go:373] Failed to initialize SDK client: rpc error: code = Unavailable desc = rpc error: code = Unavailable desc = retry budget exhausted (6 attempts): all SubConns are in TransientFailure, authentication type (identity) used="external authentication token (gcert?)"
I0314 15:18:49.443053 11928 server.go:218] Startup status: Input Processor started? true, RBE connected (or disabled)? false, Startup error? true
```
I also attached full log below, Any advice for troubleshooting this guys, many thanks!

[fullog.zip](https://github.com/bazelbuild/reclient/files/14599082/fullog.zip)

Contributor guide

Open the contributing guide

Research direction

Start with the authentication failure reported at capabilities.go:68 and the SDK initialization error at main.go:373; use the attached reproxy log and custom credential-helper configuration to reproduce the GetCapabilities call. Trace how the external token is passed through startup, then verify that reclient can initialize and authenticate successfully against the Buildbarn server.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.