elastic / elastic/elastic-agent
Agent Uninstallation fails after uninstall token rotation as the new token is rejected and the previous token remains valid.
- Dominant language
- Go
- Stars
- 275
- Forks
- 264
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 303
Description
**Kibana version:**
```
VERSION: 9.6.0-SNAPSHOT
BUILD: 108593
COMMIT: fe4dd4b35f83880847af036b1c9d148f5043c38b
```
**Operating Systems**
Operating System | Reproducible | New Token | Previous Token
-- | -- | -- | --
Windows | Yes | ❌ Invalid Token | ✅ Valid
macOS | Yes | ❌ Invalid Token | ✅ Valid
Linux | Yes | ❌ Invalid Token | ✅ Valid
**Artifact: https://snapshots.elastic.co/9.6.0-ddd98c79/downloads/**
**Preconditions:**
1. 9.6.0-SNAPSHOT cloud environment should be available.
2. An Agent policy should be created with Agent Tamper Protection enabled.
3. Agents with different operating systems should be enrolled with the created Agent Policy.
**Steps to reproduce:**
1. Navigate to Fleet > Agents.
2. Select the policy with which the agents are enrolled.
3. Navigate to Settings of the Agent Policy.
4. Click the Rotate Uninstall Token button under the Agent Tamper Protection section.
5. Wait for some time.
6. Click Get Uninstall Token and copy the uninstall command for the associated OS.
7. Try uninstalling the agent on the respective machine using the newly generated uninstall token.
8. Observe that an Invalid Token error is displayed and the agent cannot be uninstalled using the newly generated uninstall token.
**Expected behaviour:**
- After rotating the uninstall token, the newly generated token should be valid and should allow the user to successfully uninstall the agent.
- The new uninstall token should be correctly associated with the agent and remain functional after token rotation.
## Screen Capture
**Uninstall Token Rotated**
https://github.com/user-attachments/assets/e85bb7b9-5f08-4326-a578-6445c7593fd3
**Agent Uninstallation on the Machine**
https://github.com/user-attachments/assets/80c213d6-7494-4f56-b511-c52f4f60b3d9
**Additional Note:**
- The issue is consistently reproducible across all supported operating systems, including Windows, macOS, and Linux.
- The uninstall token generated at the time of Agent Policy creation successfully uninstalls the agents.
- The newly rotated uninstall token is rejected with an Invalid Token error.
- The uninstall token is updated successfully on the UI after rotation. However, the updated token is not propagated to the agent side. When the user attempts to uninstall the agent using the newly generated token, an **Invalid Token** error is displayed, while the agent still accepts the previously generated token as valid.
**Agent Uninstallation Without Token Rotation**
https://github.com/user-attachments/assets/4703ef51-ce0e-4129-8d11-e8f1c4b3f6bd
**Previous Token Still Accepted as Valid**
https://github.com/user-attachments/assets/470a8156-026a-4ff3-9268-f766f71a4811
Contributor guide
Research direction
Start by reproducing the failure from Fleet > Agents using the 9.6.0-SNAPSHOT artifact across Windows, macOS, and Linux. Trace uninstall-token rotation from the Agent Policy Settings through propagation to the agent, then verify that the newly generated token is accepted and the previous token is no longer valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100