Issues logging in with CLI after update to 1.2.0

[flimbot]

I have kanidm running in a docker instance. It's local and testing so just using self signed certs and internal dns records. I've removed certificate checks while testing.

I've found that after updating from server version 1.1.0-rc.16 to 1.2.0, I can no longer connect with the CLI tools.

Example is below where I logged in/out successfully, updated to 1.2.0 and now get the error "Unable to access token public key"

user@host:~$ kanidm login --name admin
2024-05-01T09:44:42.113128Z  WARN kanidm_client: verify_ca set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:44:42.113157Z  WARN kanidm_client: verify_hostnames set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:44:42.161290Z  WARN kanidm_client: Mismatched client and server version - features may not work, or other unforeseen errors may occur. server_version="1.1.0-rc.16" client_version="1.2.0-dev"
Enter password: 
Login Success for admin@mydomain

user@host:~$ kanidm logout
2024-05-01T09:45:28.312448Z  WARN kanidm_client: verify_ca set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:45:28.312465Z  WARN kanidm_client: verify_hostnames set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:45:28.395095Z  WARN kanidm_client: Mismatched client and server version - features may not work, or other unforeseen errors may occur. server_version="1.1.0-rc.16" client_version="1.2.0-dev"
Removed session for admin@mydomain

I then updated the image to 1.2.0

user@host:~$ kanidm login --name admin
2024-05-01T09:47:10.296934Z  WARN kanidm_client: verify_ca set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:47:10.296948Z  WARN kanidm_client: verify_hostnames set to false in client configuration - this may allow network interception of passwords!
2024-05-01T09:47:10.341217Z  WARN kanidm_client: Mismatched client and server version - features may not work, or other unforeseen errors may occur. server_version="1.2.0" client_version="1.2.0-dev"
Enter password: 
2024-05-01T09:47:16.353401Z ERROR kanidm_cli::session: Unable to access token public key

With debug it looks like this:

user@host:~$ kanidm login --name admin -d
2024-05-01T10:00:26.327555Z DEBUG kanidm: Using 16 worker threads
2024-05-01T10:00:26.327632Z DEBUG kanidm_client: Attempting to load configuration from "/etc/kanidm/config"
2024-05-01T10:00:26.327655Z DEBUG kanidm_client: "/etc/kanidm/config" does not exist
2024-05-01T10:00:26.327682Z DEBUG kanidm_client: diag=-- diagnosis for path: /etc/kanidm/config
unable to canonicalise path
running as: 1001:1002
path permissions
  /                  : DIR access: true owner: 0 group: 0 mode: rwxr-xr-x
  /etc               : DIR access: true owner: 0 group: 0 mode: rwxr-xr-x
  /etc/kanidm        : ERROR: Os { code: 2, kind: NotFound, message: "No such file or directory" }
  /etc/kanidm/config : ERROR: Os { code: 2, kind: NotFound, message: "No such file or directory" }

  note that accessibility does not account for ACL's or MAC
-- end diagnosis

2024-05-01T10:00:26.327710Z DEBUG kanidm_client: Attempting to load configuration from "/home/user/.config/kanidm"
2024-05-01T10:00:26.327725Z DEBUG kanidm_client: Successfully opened configuration file "/home/user/.config/kanidm"
2024-05-01T10:00:26.327769Z DEBUG kanidm_cli::common: Successfully loaded configuration, looked in /etc/kanidm/config and ~/.config/kanidm - client builder state: KanidmClientBuilder { address: Some("https://mydomain"), verify_ca: false, verify_hostnames: false, ca: None, connect_timeout: None, use_system_proxies: true, token_cache_path: None }
2024-05-01T10:00:26.327782Z  WARN kanidm_client: verify_ca set to false in client configuration - this may allow network interception of passwords!
2024-05-01T10:00:26.327786Z  WARN kanidm_client: verify_hostnames set to false in client configuration - this may allow network interception of passwords!
2024-05-01T10:00:26.378141Z  WARN auth_step_init{ident="admin"}: kanidm_client: Mismatched client and server version - features may not work, or other unforeseen errors may occur. server_version="1.2.0" client_version="1.2.0-dev"
2024-05-01T10:00:26.378167Z DEBUG auth_step_init{ident="admin"}: kanidm_client: opid -> "b80fc2d6-42b6-4961-b72e-4fc36fcadebd"
2024-05-01T10:00:26.378200Z DEBUG auth_step_init{ident="admin"}: kanidm_client: Authentication Session ID -> 00000000-6632-12ba-1670-2bd807e15da1
2024-05-01T10:00:26.378932Z DEBUG auth_step_begin{mech=Password}: kanidm_client: opid -> "ebc3fe5d-fc93-4922-99b3-cf05e9a32a54"
2024-05-01T10:00:26.378956Z DEBUG auth_step_begin{mech=Password}: kanidm_client: Authentication Session ID -> 00000000-6632-12ba-1670-2bd807e15da1
2024-05-01T10:00:26.378975Z DEBUG kanidm_cli::session: Allowed mechanisms -> [Password]
Enter password: 
2024-05-01T10:00:55.019085Z DEBUG auth_step_password: kanidm_client: opid -> "97da4dee-3c73-4563-9b3f-869cf6644a7f"
2024-05-01T10:00:55.019169Z DEBUG kanidm_cli::session: Attempting to read tokens from "/home/user/.cache/kanidm_tokens"
2024-05-01T10:00:55.019233Z ERROR kanidm_cli::session: Unable to access token public key

Kanidm version details

• Output of kanidm(d) version:

  • Client kanidm 1.2.0-dev, 2024-05-01T10:04:27.221620Z DEBUG kanidm: Using 16 worker threads
  • Within container kanidmd 1.2.0

• Are you running it in a container? If so, which image/tag?:

  • Yes, running in a docker container with compose, image is: kanidm/server:latest

• Operating System / Version (On Unix please post the output of uname -a):

  • Client on: Linux HOSTNAME 6.5.0-28-generic #29~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Apr 4 14:39:20 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
  • Containers on: Linux HOSTNAME 5.15.0-105-generic #115-Ubuntu SMP Mon Apr 15 09:52:04 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

I thought this was a client issue initially, but since the server version made a difference. Has anybody got any thoughts of what to check next? Posting here because raising as a bug felt premature.

[yaleman]

Try clearing the token cache at ~/.cache/kanidm_tokens by deleting the file, it won't break anything.

[flimbot]

Thanks for the responses Yaleman.
That error was similar to what I got when I deleted. I think it remains similar with an empty file, and needs the json {}

The kanidm CLI client was installed from the ppa package.
I'll pull an updated version tonight to have another go and report back.

Failing that, I'll start a new kanidm container just in case.

On aside, I really appreciate this project I'm just a little out of my depth with understanding some of it.

[Firstyear]

The PPA tracks dev builds which may be the issue here in this case. The error you're seeing we think we resolved late in the 1.2.0-dev cycle, so hopefully an update fixes. Sorry this upgrade hasn't been flawless for you :(

[flimbot]

No worries, that's all part of the journey. I appreciate all you're doing.

[flimbot]

Hooray!

I updated to 1.3.0-dev as it was available in the releases as a deb, seems to log in now, which is fantastic!
The debs in the ppa don't have 1.3.0 yet https://github.com/kanidm/kanidm_ppa/tree/main/ubuntu

Thanks so much for your help

[yaleman]

Yep, the auto-update is broken currently

[Firstyear]

Closing as this appears to be resolved.