ad-hoc 401 Unauthorized errors

[KevinJTaylor]

Hi all, has anyone else encountered random errors when running tests against jwx-enabled restful services?

I'm using httpexpect to do these test, generating an access token and calling the endpoint in my test, validating the response code and if that works obviously the data itself (obviously I'm using jwx (jwk/jwt) to do the authentication/authorisation). Generally what happens is, one or two tests fail on each run due to a 401 Unauthorized error, but it is nearly always different tests. I believe the problem is down to expiry, but that is a guess, and it is difficult to be sure due to the randomness of the failures.

Any ideas?

    chain.go:21: 
        expected status equal to:
         "200 OK"
        
        but got:
         "401 Unauthorized"

[lestrrat]

I think you will need to provide more details/code. Also, do you not have control over the server side? If you do it would be much easier to sprinkle debug logs than to try to guess what the cause might be.

[lestrrat]

Your test case doesn't run on its own, so I couldn't verify. On the other hand I tried running the tests in validate_test.go that explicitly test iat 1000 times each, and I can't reproduce :/

[KevinJTaylor]

What I don't get is how 'now' can be after 'ttv' tbh, but I guess that is pretty obvious ... in effect any rounding or truncation will not help if the two times are across the 'second barrier' (unless it was rounded/truncated to a minute, which doesn't make sense)

I'm inclined to look at the oauth library (idtoken) to see specifically what that does and see if that helps ... I do also have it at the back of my mind that although this may be the problem with my tests it may not be the occasional problem I get when running using the real service.

[KevinJTaylor]

I can give you the ks code (which is really just a provider for KeySetFrom), see below. The only other missing piece is the service account definition. I exported this from the google api console and then created the Mock service account from it (which I use in my tests)

type ks struct{}

func (k *ks) KeySetFrom(token jwt.Token) (jwk.Set, error) {
	discoveryDocument, err := getJSON("https://accounts.google.com/.well-known/openid-configuration")
	if err != nil {
		return nil, errors.Wrap(err, "cannot retrieve discovery document")
	}

	rawKeySet, err := getJSON(discoveryDocument[JWKsURI].(string))
	if err != nil {
		return nil, errors.Wrap(err, "cannot retrieve key set")
	}

	keySet := jwk.NewSet()
	for _, element := range rawKeySet["keys"].([]interface{}) {
		rawKey, err := json.Marshal(element)
		if err != nil {
			return nil, errors.Wrap(err, "cannot encode key")
		}

		key, err := jwk.ParseKey(rawKey)
		if err != nil {
			return nil, errors.Wrap(err, "cannot parse key")
		}

		keySet.Add(key)
	}
	return keySet, nil
}

[lestrrat]

Hmmm, well, I guess idtoken.NewTokenSource() makes a remote request eventually, so then my next guess may just be that your clocks are not exactly in sync, and that you may need to add some skew? jwt.WithAcceptableSkew(5*time.Seconds) maybe?

[KevinJTaylor]

Ahhh ok, that does make perfect sense
... thanks for your all your help @lestrrat, you've been jwx-cellent ;)