bazelbuild / bazelbuild/reclient
Getting error when using credential helper: "externally provided auth token was invalid"
- Dominant language
- Go
- Stars
- 114
- Forks
- 25
- PR merge metrics
- No merged PRs in 30d
Description
Hi guys, I'm trying to use reclient with buildbarn. My authentication method uses a custom credential helper, in my case it was just echo hard coded json like this:
```
{
"token": "eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJhZG1pbiIsImFjY2Vzc190b2tlbiI6InRlc3RfYnVpbGRiYXJuIiwidG9rZW5fdHlwZSI6IkJlYXJlciIsImV4cGlyZXNfaW4iOjB9.Buen5gwvRe5daKqajuscm-NK2hQ-zt3s9wQC_SXe_oeSVxmQCe-Hl0R99U5OxMX6xBitBcIVi6rcW1QKm81VTAWGdkLxY6BBBy9zElBd3otG3wb8AX7Zmjt5xz5zzbP0I0ocVye8w9OAR_wOiJ4ShQdhpfUXjeRgFgEw0H7cEbp-Fo6mydIMmkVGEH1USvxK-hlynfZ1X_y4AemQgN5YcyLAQ3apGTDll14-83RcWSlQ8z5NGqwNLpmuObNP9VHZ8fo6zIGNDwEcQV2WGMafx3JTsci6v4LgpAbuqyZeYq6PPoiubOPYoBL1svYsnjHXfWgJ5YKtimmCOLDm2SQOaA",
"expiry":"Sat Mar 15 14:21:16 CET 2024",
"refresh_expiry":"Sat Mar 15 14:21:16 CET 2024"
}
```
I was able to authenticate with my builbarn server using above token (send a `GetCapabilities `request via postman grpc) but reclient complain with error `Command failed: rpc error: code = Unauthenticated desc = Unable to authenticate with RBE, externally provided auth token was invalid`
This is a part in reproxy.Info log showing that the call to GetCapabilities fails
```
I0314 15:18:47.055880 11928 depsscannerclient.go:184] Connected to dependency scanner service on 127.0.0.1:58654
I0314 15:18:47.055978 11928 main.go:342] Finished setting up input processor
I0314 15:18:47.055978 11928 server.go:218] Startup status: Input Processor started? true, RBE connected (or disabled)? false, Startup error? false
I0314 15:18:47.639044 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:47.857893 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.130595 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.474757 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:48.802904 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
I0314 15:18:49.435857 11928 capabilities.go:68] call failed with err=rpc error: code = Unavailable desc = all SubConns are in TransientFailure, retrying.
E0314 15:18:49.435857 11928 main.go:373] Failed to initialize SDK client: rpc error: code = Unavailable desc = rpc error: code = Unavailable desc = retry budget exhausted (6 attempts): all SubConns are in TransientFailure, authentication type (identity) used="external authentication token (gcert?)"
I0314 15:18:49.443053 11928 server.go:218] Startup status: Input Processor started? true, RBE connected (or disabled)? false, Startup error? true
```
I also attached full log below, Any advice for troubleshooting this guys, many thanks!
[fullog.zip](https://github.com/bazelbuild/reclient/files/14599082/fullog.zip)
Contributor guide
Research direction
Start with the authentication failure reported at capabilities.go:68 and the SDK initialization error at main.go:373; use the attached reproxy log and custom credential-helper configuration to reproduce the GetCapabilities call. Trace how the external token is passed through startup, then verify that reclient can initialize and authenticate successfully against the Buildbarn server.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100