elastic / elastic/elastic-agent

Agent Uninstallation fails after uninstall token rotation as the new token is rejected and the previous token remains valid.

Open
#16,201 9 comments 0 reactions 0 assignees View on GitHub
bug impact:high Team:Elastic-Agent-Control-Plane
Dominant language
Go
Stars
275
Forks
264
Avg merge
1d 20h
Merged PRs (30d)
303

Description

**Kibana version:**
```
VERSION: 9.6.0-SNAPSHOT
BUILD: 108593
COMMIT: fe4dd4b35f83880847af036b1c9d148f5043c38b
```
**Operating Systems**
Operating System | Reproducible | New Token | Previous Token
-- | -- | -- | --
Windows | Yes | ❌ Invalid Token | ✅ Valid
macOS | Yes | ❌ Invalid Token | ✅ Valid
Linux | Yes | ❌ Invalid Token | ✅ Valid

**Artifact: https://snapshots.elastic.co/9.6.0-ddd98c79/downloads/**

**Preconditions:**

1. 9.6.0-SNAPSHOT cloud environment should be available.
2. An Agent policy should be created with Agent Tamper Protection enabled.
3. Agents with different operating systems should be enrolled with the created Agent Policy.

**Steps to reproduce:**

1. Navigate to Fleet > Agents.
2. Select the policy with which the agents are enrolled.
3. Navigate to Settings of the Agent Policy.
4. Click the Rotate Uninstall Token button under the Agent Tamper Protection section.
5. Wait for some time.
6. Click Get Uninstall Token and copy the uninstall command for the associated OS.
7. Try uninstalling the agent on the respective machine using the newly generated uninstall token.
8. Observe that an Invalid Token error is displayed and the agent cannot be uninstalled using the newly generated uninstall token.

**Expected behaviour:**

- After rotating the uninstall token, the newly generated token should be valid and should allow the user to successfully uninstall the agent.
- The new uninstall token should be correctly associated with the agent and remain functional after token rotation.

## Screen Capture

**Uninstall Token Rotated**

https://github.com/user-attachments/assets/e85bb7b9-5f08-4326-a578-6445c7593fd3

**Agent Uninstallation on the Machine**

https://github.com/user-attachments/assets/80c213d6-7494-4f56-b511-c52f4f60b3d9

**Additional Note:**

- The issue is consistently reproducible across all supported operating systems, including Windows, macOS, and Linux.
- The uninstall token generated at the time of Agent Policy creation successfully uninstalls the agents.
- The newly rotated uninstall token is rejected with an Invalid Token error.
- The uninstall token is updated successfully on the UI after rotation. However, the updated token is not propagated to the agent side. When the user attempts to uninstall the agent using the newly generated token, an **Invalid Token** error is displayed, while the agent still accepts the previously generated token as valid.

**Agent Uninstallation Without Token Rotation**

https://github.com/user-attachments/assets/4703ef51-ce0e-4129-8d11-e8f1c4b3f6bd

**Previous Token Still Accepted as Valid**

https://github.com/user-attachments/assets/470a8156-026a-4ff3-9268-f766f71a4811

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure from Fleet > Agents using the 9.6.0-SNAPSHOT artifact across Windows, macOS, and Linux. Trace uninstall-token rotation from the Agent Policy Settings through propagation to the agent, then verify that the newly generated token is accepted and the previous token is no longer valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.