search

1Password / connect

Access your 1Password secrets using a 1Password Connect Server
https://developer.1password.com/docs/connect
149 stars 28 forks source link

Invalid bearer token warning messages #54

Open Wopple opened 1 year ago

Wopple commented 1 year ago

I'm getting the following warning message in the connect logs:

> kubectl logs onepassword-connect-<id>
...
{"log_message":"(W) Server: (failed to createVerifiedAccess), Authentication: (Invalid bearer token), square/go-jose/jwt: validation failed, token is expired (exp)","timestamp":"<timestamp>","level":2,"scope":{"request_id":"<request-id>","jti":"<jti>"}}
...

It seems to still be working with the connect operator, but these warning are concerning me. What are these about? Can I resolve this?

andrewmarklloyd commented 1 year ago

I got this error as well today. I'm running connect server on Docker but not Kubernetes FWIW. I found that my 1password-credentials.json credentials were expired. It was not clear anywhere to me where to find the expiration for those credentials. I saw clearly that the tokens created for my connect server have expiration dates, and my tokens were not expired. I could not find a way to refresh these credentials so I actually had to delete my integration and create a new one.

Even though these are logged as warn level logs, they caused my applications relying on the connect server to fail to start. Luckily this is a personal project that only I use, but if this were a production application this would have caused an outage.

It would be good to know the expiration of these credentials and how to renew them if possible. Sorry to piggyback on your issue @Wopple, but I was going to create one when I found yours. I believe it's the same issue I faced though.

jillianwilson commented 1 year ago

Thank you for your feedback! @Wopple did you try creating a new credentials file as @andrewmarklloyd suggested? Notification around credentials expiry, as well as regenerating new credentials could definitely use some improvements. We have plans to make these improvements in the future but I'm unable to give a concrete timeline at the moment.