hashicorp / hashicorp/vault-action

[BUG] Exception hit during verify_github_token: The token is not yet valid (iat)

Open
#548 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
JavaScript
Stars
513
Forks
166
Avg merge
6d 4h
Merged PRs (30d)
1

Description

## Vault server version
v1.14.1

## vault-action version
v2.7.4

## Describe the bug
We ran into a scenario where we believe clock drift between the github runner and the vault server were out of sync; specifically the runner being ahead of the vault. This resulted in authentication failures.

## To Reproduce
Set the issued at (IAT) to a time farther in the future.

## Expected behavior
Error free authentication.

## Log Output
Exception hit during verify_github_token: The token is not yet valid (iat)

## Additional context
Github recommends setting the issued at (iat) to 60 seconds in the past to better handle this scenario, however the action currently uses now().

https://docs.github.com/en/enterprise-server@3.12/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app

For our Hashi friends, please reference ticket 144645 since we weren't able to have a deeper conversation around https://developer.hashicorp.com/vault/api-docs/auth/jwt#clock_skew_leeway.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the verify_github_token authentication path identified in the log and compare its issued-at handling with GitHub's JWT guidance linked in the issue. Done means authentication remains error-free when the runner clock is ahead of Vault within the described drift scenario, while preserving normal token verification.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, javascript
Domain
authentication, ci-cd, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.