Session token not found or invalid

[remixtj]

Describe the bug
After a while from the login, i can't start a session on a given accout when using SSO.

Leapp Version
0.15.1 and 0.14.3 (did downgrade to check if problem was persisting)

To Reproduce
Steps to reproduce the behavior:

1. Login via AWS SSO
2. Start a new session on a listed account
3. After a while try starting another one, you'll get "Session token not found or invalid".

Expected behavior
A session is started, with no error.

** Logs **

[2022-10-10 13:34:09.460] [info]  [renderer] Opening web console for session: AziendaZero
[2022-10-10 13:34:09.474] [info]  [renderer] Starting opening Web Console
[2022-10-10 14:53:05.149] [info]  [renderer] Starting Session
[2022-10-10 14:53:05.430] [error] [renderer] [ErrorService] UnauthorizedException: Session token not found or invalid
    at Object.extractError (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:32758:27)
    at Request.extractError (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:33138:8)
    at Request.callListeners (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:35899:20)
    at Request.emit (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:35866:10)
    at Request.emit (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:34462:14)
    at Request.transition (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:33788:10)
    at AcceptorStateMachine.runTo (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:40088:12)
    at file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:40099:10
    at Request.<anonymous> (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:33804:9)
    at Request.<anonymous> (file:///opt/Leapp/resources/app.asar/dist/leapp-client/main.34a8122b32e1d613.js:34464:12)
[2022-10-10 14:59:47.111] [info]  [renderer] Starting Session

First two lines of logs shows a successful operation. Then the problem appeared.

Desktop (please complete the following information):

• Ubuntu 22.04
• Leapp 0.14.3 and 0.15.1

[remixtj]

Sometime also happens when you restart Leapp. SSO Is marked as green, but if you try to start a session, you get Session token not found or invalid

[hoegertn]

I can confirm. The same reappeared for me also some days ago.

[urz9999]

And perhaps if you do a logout/login again it will work as expected?

[hoegertn]

Most of the time this helps but is not a great UX.

[remixtj]

And perhaps if you do a logout/login again it will work as expected?

Yes, it does. It's the only way i have to start using again.

[andreacavagna01]

Agree with @hoegertn, this is not the best UX possible, I think this is still a bug

[gshpychka]

@ericvilla informed me that this is pertinent info: I also run into this every once in a while (it's pretty rare), and I have a aws-sso-access-token secret in my OS Keychain (I use ArchLinux). Apparently this corresponds to an older token format that Leapp used to use. Logging out and back in does solve the problem (removing the secret does not).

[urz9999]

Most of the time this helps but is not a great UX.

I know, I requested just to try to understand where the problem lies

[ericvilla]

To test the AWS SSO Integration code, we set a fake expiration 2 minutes after the sign-in; in addition, we set the AWS SSO Sessions rotation to happen every 60 seconds. We used this configuration to force a new login after two minutes; it worked. We need to further investigate the reported issue; any additional info that you can provide is critical for us during the debugging phase. Please, let us know if there is any other context information that is missing in the GitHub Issue description (e.g. in-app operations, AWS SSO integration with external IdPs, etc.). Thanks!

[remixtj]

Hello, we use in-app operation, SSO integration is with our AD domain. I don't know which other infos i can provide you.

[ericvilla]

Hi @remixtj, we weren't able to reproduce the error, even by removing network connectivity. To give you the possibility to provide more info to reproduce it, we're going to refactor the logging system to include the stack trace that, as far as now, points to .js file (transpiled version)

[remixtj]

Let me know when i can make tests, me and other colleagues are struggling with this issue.

[eswidler]

Myself and another team member are also running this. The workaround is just to log out and log into the integration. But also tired of doing this 😆 It seems to happen after leaving a session running for a few hours.

In my keychain I have an old aws-sso-cli entry. Per the comment from @gshpychka this might be relevant info. I'm going to try deleting this to see if it goes away, since I'm now using Leapp instead for managing credentials 🤞.

We're on MacOS 12.6 and I'm using Leapp 0.15.0. @ericvilla let me know when the more verbose logs are available and how I can retrieve those if this happens again.

[AshTharappel]

I am also having this issue Mac Os 12.5.1 Leapp 0.15.1 Leapp-cli 0.1.23

[ericvilla]

Hi everyone, we managed to restrict the portion of code that generated that issue.

It seems the accessToken - generated during the AWS SSO OIDC login - expires before the expected 8hrs (as documented by AWS).

Therefore, we applied a forced refresh of the accessToken when the getRoleCredentials call fails. In particular, we added an optional forceRefresh parameter to the getAccessToken method. It triggers a new OIDC login flow that, if you are already logged into AWS SSO, requires you to allow the device authorization request.

let accessToken = await this.awsIntegrationDelegate.getAccessToken(session.awsSsoConfigurationId, region, portalUrl);
let credentials;

try {
  credentials = await this.awsIntegrationDelegate.getRoleCredentials(accessToken, region, roleArn);
} catch (err) {
  accessToken = await this.awsIntegrationDelegate.getAccessToken(session.awsSsoConfigurationId, region, portalUrl, true);
  credentials = await this.awsIntegrationDelegate.getRoleCredentials(accessToken, region, roleArn);
}

Still, we're going to investigate the OIDC device authorization flow, as it is related to an expiration value too.

[ericvilla]

Hi everyone!

We've generated a nightly build that implements the solution described in the last comment.
Please, let us know if the reported issue still occurs during your working day or if it is fixed.
We expect Leapp to trigger a new OIDC login flow that, if you are already logged into AWS SSO, requires you to allow the device authorization request.

We're going to provide the installation packages link in the 07-leapp-development channel of the TOPS Community.

[chrisvoo]

Hi, I have Leapp 0.24.6 on Mac M1 and still getting this error (AWS SSO). Logging out makes it work again.