token validation errors

[bwiseman]

Hi,
I have deployed the Azure TRE from github and have it working to a degree. There were no deployment errors that I spotted. I can deploy workspaces and resources. The problem seems to be with AAD and authentication and tokens.

• if a workspace is set to create AAD groups then it fails to deploy.

Does this look familiar to anyone? The cert, secrets etc all seem to be there. If I check the Azure activity logs everything says 'succeeded'. I'm running as the tenant admin. The TRE Admin and User roles have been created and assigned. Not sure where to look next. Clues anyone?

---

Workspace build error (when AAD groups are to be created)

Error: Unable to decode or validate token at https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:734773 at p (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:399423) at Generator.<anonymous> (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:400760) at Generator.next (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:399786) at i (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:405415) at s (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:405618)

[marrobi]

Hi @bwiseman .

Can you confirm what you have AUTO_WORKSPACE_APP_REGISTRATION and AUTO_WORKSPACE_GROUP_CREATION set to in the config.yaml file? For the AAD group creation to work AUTO_WORKSPACE_GROUP_CREATION needs to be true when you run make auth. We have an issue to track this here - #2628 .

For the 401 on Guacamole - Invalid audience - is odd, given you have been able to authenticate to create the service. Where is that error retrieved from?

Thanks.

[bwiseman]

AUTO_WORKSPACE_APP_REGISTRATION is true
but
AUTO_WORKSPACE_GROUP_CREATION was false.

I'll run the make auth again then?

The guacamole token error might be a red herring. I fired up another browser flavour and connected as a user. Managed to reach the guacamole dashboard without the error but the VM isn't offered. That's probably a separate issue.

[marrobi]

Yes, run make auth and then make deploy-core to update the deployment.

[bwiseman]

yaml.conf updated, make auth run, deploy-core run, deleted the workspace and tried to create again. Unfortunately I'm still getting the token error if I turn on create AAD groups. Do I tear down the TRE and redeploy the whole thing while I mutter some different secret good luck chants?

Error: Unable to decode or validate token at https://###.cloudapp.azure.com/static/js/main.439310b7.js:2:734773 at p (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:399423) at Generator. (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:400760) at Generator.next (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:399786) at i (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:405415) at s (https://####.cloudapp.azure.com/static/js/main.439310b7.js:2:405618)

[marrobi]

Where are you seeing this error?

Can you check the workspace deployment logs via: https://###.cloudapp.azure.com/api/docs and the workspaces/<workspace_id>/operations endpoint?

(to authenticate, click authenticate in the Swagger UI - no client secret required.

[bwiseman]

I was deploying the build logged in as a tenant admin... that sane account had all the tre admin, user, workspace owner etc permissions granted. I could create workspaces and user resources in the tre ui. If I tried to connects via guacamole to a vm then I got the error.

Spinning up a different browser, logging in as another user with tre user, and workspace owner/researcher permissions and then no error when I connect to a vm. Don't know if that's the expected behaviour but that's certainly the workaround.