hashicorp / hashicorp/vault-action
[BUG] Exception hit during verify_github_token: The token is not yet valid (iat)
- Dominant language
- JavaScript
- Stars
- 513
- Forks
- 166
- Avg merge
- 6d 4h
- Merged PRs (30d)
- 1
Description
## Vault server version
v1.14.1
## vault-action version
v2.7.4
## Describe the bug
We ran into a scenario where we believe clock drift between the github runner and the vault server were out of sync; specifically the runner being ahead of the vault. This resulted in authentication failures.
## To Reproduce
Set the issued at (IAT) to a time farther in the future.
## Expected behavior
Error free authentication.
## Log Output
Exception hit during verify_github_token: The token is not yet valid (iat)
## Additional context
Github recommends setting the issued at (iat) to 60 seconds in the past to better handle this scenario, however the action currently uses now().
https://docs.github.com/en/enterprise-server@3.12/apps/creating-github-apps/authenticating-with-a-github-app/generating-a-json-web-token-jwt-for-a-github-app
For our Hashi friends, please reference ticket 144645 since we weren't able to have a deeper conversation around https://developer.hashicorp.com/vault/api-docs/auth/jwt#clock_skew_leeway.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the verify_github_token authentication path identified in the log and compare its issued-at handling with GitHub's JWT guidance linked in the issue. Done means authentication remains error-free when the runner clock is ahead of Vault within the described drift scenario, while preserving normal token verification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, javascript
- Domain
- authentication, ci-cd, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100