[GH-ISSUE #5776] Linux Client Breaks after upgrade from 0.67.1 to 0.67.2 #11971

Closed
opened 2026-08-05 01:31:56 -04:00 by saavagebueno · 9 comments
Owner

Originally created by @robertpenz on GitHub (Apr 2, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5776

Describe the problem

After update of the rpm from 0.67.1 to 0.67.2 the client can't authenticate via SSO anymore.

Error: daemon up failed: sso login failed: waiting sso login failed with: rpc error: code = Unknown desc = PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed"
> sudo tail -f /var/log/netbird/client.log 
2026-04-02T09:54:35.314+02:00 INFO client/server/server.go:471: active profile: tirol for simon 
2026-04-02T09:54:35.314+02:00 INFO client/server/server.go:966: active profile config existed: true, err <nil> 
2026-04-02T09:54:35.380+02:00 ERRO shared/management/client/grpc.go:575: failed to login to Management Service: rpc error: code = PermissionDenied desc = peer login has expired, please log in once more 
2026-04-02T09:54:35.387+02:00 ERRO client/server/server.go:284: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0 
2026-04-02T09:54:35.441+02:00 WARN client/server/server.go:519: canceling previous waiting execution 
2026-04-02T09:54:49.622+02:00 ERRO client/server/server.go:618: waiting for browser login failed: PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed"
Apr 02 06:46:23 dnf5[1117804]:  netbird                                       x86_64 0:0.67.2-1               netbird        35.1 MiB 
Apr 02 06:46:23 dnf5[1117804]:    replacing netbird                           x86_64 0:0.67.1-1               netbird        35.0 MiB 
Apr 02 06:46:23 dnf5[1117804]:  netbird-ui                                    x86_64 0:0.67.2-1               netbird        38.2 MiB 
Apr 02 06:46:23 dnf5[1117804]:    replacing netbird-ui                        x86_64 0:0.67.1-1               netbird        38.1 MiB

To Reproduce

Upgrade --> does not work
Downgrade --> Works again

Originally created by @robertpenz on GitHub (Apr 2, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5776 **Describe the problem** After update of the rpm from 0.67.1 to 0.67.2 the client can't authenticate via SSO anymore. ``` Error: daemon up failed: sso login failed: waiting sso login failed with: rpc error: code = Unknown desc = PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed" ``` ``` > sudo tail -f /var/log/netbird/client.log 2026-04-02T09:54:35.314+02:00 INFO client/server/server.go:471: active profile: tirol for simon 2026-04-02T09:54:35.314+02:00 INFO client/server/server.go:966: active profile config existed: true, err <nil> 2026-04-02T09:54:35.380+02:00 ERRO shared/management/client/grpc.go:575: failed to login to Management Service: rpc error: code = PermissionDenied desc = peer login has expired, please log in once more 2026-04-02T09:54:35.387+02:00 ERRO client/server/server.go:284: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0 2026-04-02T09:54:35.441+02:00 WARN client/server/server.go:519: canceling previous waiting execution 2026-04-02T09:54:49.622+02:00 ERRO client/server/server.go:618: waiting for browser login failed: PKCE authorization flow failed: oauth2: "invalid_client" "Client authentication failed" ``` ``` Apr 02 06:46:23 dnf5[1117804]: netbird x86_64 0:0.67.2-1 netbird 35.1 MiB Apr 02 06:46:23 dnf5[1117804]: replacing netbird x86_64 0:0.67.1-1 netbird 35.0 MiB Apr 02 06:46:23 dnf5[1117804]: netbird-ui x86_64 0:0.67.2-1 netbird 38.2 MiB Apr 02 06:46:23 dnf5[1117804]: replacing netbird-ui x86_64 0:0.67.1-1 netbird 38.1 MiB ``` **To Reproduce** Upgrade --> does not work Downgrade --> Works again
saavagebueno added the triage-needed label 2026-08-05 01:31:56 -04:00
Author
Owner

@jnfrati commented on GitHub (Apr 2, 2026):

Hey @robertpenz! Thanks for the report, could you tell me what OS are you running and if you're trying to connect to cloud or selfhosted?

<!-- gh-comment-id:4176141398 --> @jnfrati commented on GitHub (Apr 2, 2026): Hey @robertpenz! Thanks for the report, could you tell me what OS are you running and if you're trying to connect to cloud or selfhosted?
Author
Owner

@simon04 commented on GitHub (Apr 2, 2026):

I'm one affected user. It's a self-hosted instance.

> cat /etc/fedora-release 
Fedora release 44 (Forty Four)

> dnf list --installed | grep netbird
netbird.x86_64                                       0.67.2-1                            netbird
netbird-ui.x86_64                                    0.67.2-1                            netbird

> cat /etc/yum.repos.d/netbird.repo 
[netbird]
name=netbird
baseurl=https://pkgs.netbird.io/yum/
enabled=1
gpgcheck=0
gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key
repo_gpgcheck=1
<!-- gh-comment-id:4176233959 --> @simon04 commented on GitHub (Apr 2, 2026): I'm one affected user. It's a self-hosted instance. ``` > cat /etc/fedora-release Fedora release 44 (Forty Four) > dnf list --installed | grep netbird netbird.x86_64 0.67.2-1 netbird netbird-ui.x86_64 0.67.2-1 netbird > cat /etc/yum.repos.d/netbird.repo [netbird] name=netbird baseurl=https://pkgs.netbird.io/yum/ enabled=1 gpgcheck=0 gpgkey=https://pkgs.netbird.io/yum/repodata/repomd.xml.key repo_gpgcheck=1 ```
Author
Owner

@robertpenz commented on GitHub (Apr 2, 2026):

Tested on current Ubuntu and Fedora, and we're running selfhosted with our own IDP based on Shibboleth. The updates came in both cases via the package management (apt and dnf)

A colleague did take a look at the diff e5914e4e8b and thinks that following looks interesting.

[management,client] Remove client secret from gRPC auth flow (#5751)
Remove client secret from gRPC auth flow. The secret was originally included to support providers like Google Workspace that don't offer a proper PKCE flow, but this is no longer necessary with the embedded IdP. Deployments using such providers should migrate to the embedded IdP instead.

<!-- gh-comment-id:4176237419 --> @robertpenz commented on GitHub (Apr 2, 2026): Tested on current Ubuntu and Fedora, and we're running selfhosted with our own IDP based on Shibboleth. The updates came in both cases via the package management (apt and dnf) A colleague did take a look at the diff https://github.com/netbirdio/netbird/commit/e5914e4e8b0ae030701529eb4f492d49eb10534b and thinks that following looks interesting. [management,client] Remove client secret from gRPC auth flow (#5751) Remove client secret from gRPC auth flow. The secret was originally included to support providers like Google Workspace that don't offer a proper PKCE flow, but this is no longer necessary with the embedded IdP. Deployments using such providers should migrate to the embedded IdP instead.
Author
Owner

@DanTaff commented on GitHub (Apr 2, 2026):

Good day all. Selfhosted here too

Image

Tried downgrading to 0.66.4 but still down. Created a new profile, the Netbird icon then shows connected, but still unable to access resources behind Netbird.

Image

Have tried all the standard fixes: restarted server docker containers, flushed routing table and DNS.

Let me know if I can provide anything to help get this fixed pronto

<!-- gh-comment-id:4176453965 --> @DanTaff commented on GitHub (Apr 2, 2026): Good day all. Selfhosted here too <img width="1162" height="716" alt="Image" src="https://github.com/user-attachments/assets/7c42e955-f006-41cc-8301-cc02d2cb42b2" /> Tried downgrading to 0.66.4 but still down. Created a new profile, the Netbird icon then shows connected, but still unable to access resources behind Netbird. <img width="121" height="78" alt="Image" src="https://github.com/user-attachments/assets/dd856ae9-2a86-40ca-b781-272458f2ccd9" /> Have tried all the standard fixes: restarted server docker containers, flushed routing table and DNS. Let me know if I can provide anything to help get this fixed pronto
Author
Owner

@DanTaff commented on GitHub (Apr 2, 2026):

Fix was:

Open terminal and run netbird down and sudo netbird service uninstall
Quit Netbird from the menubar icon (top right)
Finder > Applications > Right click Netbird and Move to Bin
Download and install 0.66.4: https://github.com/netbirdio/netbird/releases/download/v0.66.4/netbird_0.66.4_darwin_arm64.pkg
Reboot

Make sure GUI and CLI version match

Image
<!-- gh-comment-id:4176960490 --> @DanTaff commented on GitHub (Apr 2, 2026): Fix was: Open terminal and run netbird down and sudo netbird service uninstall Quit Netbird from the menubar icon (top right) Finder > Applications > Right click Netbird and Move to Bin Download and install 0.66.4: https://github.com/netbirdio/netbird/releases/download/v0.66.4/netbird_0.66.4_darwin_arm64.pkg Reboot Make sure GUI and CLI version match <img width="177" height="110" alt="Image" src="https://github.com/user-attachments/assets/bc9bb43e-a045-42f2-ba97-c39636ffb924" />
Author
Owner

@debugger22 commented on GitHub (Apr 2, 2026):

This is happening in windows and macos as well.

<!-- gh-comment-id:4177631077 --> @debugger22 commented on GitHub (Apr 2, 2026): This is happening in windows and macos as well.
Author
Owner

@simon04 commented on GitHub (Apr 2, 2026):

See https://github.com/netbirdio/netbird/pull/5781 for a pull request for reverting the relevant change.

<!-- gh-comment-id:4178627339 --> @simon04 commented on GitHub (Apr 2, 2026): See https://github.com/netbirdio/netbird/pull/5781 for a pull request for reverting the relevant change.
Author
Owner

@simon04 commented on GitHub (Apr 2, 2026):

https://github.com/netbirdio/netbird/releases/tag/v0.67.3 has been released.

<!-- gh-comment-id:4180244686 --> @simon04 commented on GitHub (Apr 2, 2026): https://github.com/netbirdio/netbird/releases/tag/v0.67.3 has been released.
Author
Owner

@robertpenz commented on GitHub (Apr 7, 2026):

Updated Version works. Thx.

<!-- gh-comment-id:4197611780 --> @robertpenz commented on GitHub (Apr 7, 2026): Updated Version works. Thx.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#11971