DYNR/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-05 00:15:26 -04:00
Code Issues 23.5k Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #2207] Netbird doesn't work with Keycloak with LDAPS for Account Delegation #4382

New Issue
Open
opened 2026-08-05 00:57:26 -04:00 by saavagebueno · 23 comments
saavagebueno commented 2026-08-05 00:57:26 -04:00
Owner
Copy Link

Originally created by @michelangelo136 on GitHub (Jun 27, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2207

Describe the problem

While running Netbird with Keycloak I can authenticate and connect while using the local accounts, but when I enable account federation with LDAPS on Keycloak, the authentication stops working and I can no longer login or use Netbird.

To Reproduce

Steps to reproduce the behavior:

  1. Install the latest Netbird version with the script
  2. Connect Netbird with Keycloak
  3. Keycloak has LDAPS account federation enabled
  4. Try to connect to Netbird with SSO
  5. After authenticating with Keycloak, see the Netbird loading screen with no responses.
  6. Get the screen popup error: "Request failed with status code 401 Error: Token invalid"

Expected behavior
The Netbird dashboard should load.

Are you using NetBird Cloud?
No, Netbird selfhosted

NetBird version
0.28.3

Screenshots

image

Additional context

Netbird works if Keycloak doesn't use LDAPS federated users, when adding the Federated users it stops working, I also get the following error some times: ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://admin-keycloak.example.com:443/admin/realms/netbird/users?max=150": unexpected EOF

Originally created by @michelangelo136 on GitHub (Jun 27, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2207 **Describe the problem** While running Netbird with Keycloak I can authenticate and connect while using the local accounts, but when I enable account federation with LDAPS on Keycloak, the authentication stops working and I can no longer login or use Netbird. **To Reproduce** Steps to reproduce the behavior: 1. Install the latest Netbird version with the script 2. Connect Netbird with Keycloak 3. Keycloak has LDAPS account federation enabled 4. Try to connect to Netbird with SSO 5. After authenticating with Keycloak, see the Netbird loading screen with no responses. 6. Get the screen popup error: "Request failed with status code 401 Error: Token invalid" **Expected behavior** The Netbird dashboard should load. **Are you using NetBird Cloud?** No, Netbird selfhosted **NetBird version** 0.28.3 **Screenshots** ![image](https://github.com/netbirdio/netbird/assets/47090692/18534842-265c-4174-87e6-fe0fe6726ffb) **Additional context** Netbird works if Keycloak doesn't use LDAPS federated users, when adding the Federated users it stops working, I also get the following error some times: `ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://admin-keycloak.example.com:443/admin/realms/netbird/users?max=150": unexpected EOF`
saavagebueno added the management-servicewaiting-feedbackidpkeycloakself-hosting labels 2026-08-05 00:57:26 -04:00
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Jun 27, 2024):

Hello @michelangelo136 , can you share the management logs?

<!-- gh-comment-id:2194834269 --> @bcmmbaga commented on GitHub (Jun 27, 2024): Hello @michelangelo136 , can you share the management logs?
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Jun 27, 2024):

Hello @bcmmbaga, here are the logs.

management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401

<!-- gh-comment-id:2194903405 --> @michelangelo136 commented on GitHub (Jun 27, 2024): Hello @bcmmbaga, here are the logs. `management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401`
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Jun 27, 2024):

Hello @bcmmbaga, here are the logs.

management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401

There are missing initial logs when starting the management. Can you restart the management, and then share the logs afterwards?

<!-- gh-comment-id:2194977447 --> @bcmmbaga commented on GitHub (Jun 27, 2024): > Hello @bcmmbaga, here are the logs. > > `management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:34:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:34:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1008626266: GET /api/users status 401 management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:05Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:05Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3682479814: GET /api/users status 401 management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Post "https://sso.example.com/realms/netbird/protocol/openid-connect/token": context deadline exceeded (Client.Timeout exceeded while awaiting headers) management-1 | 2024-06-27T14:35:15Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-27T14:35:15Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2881042402: GET /api/users status 401` There are missing initial logs when starting the management. Can you restart the management, and then share the logs afterwards?
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Jun 28, 2024):

I restarted the management service, these is the log, the fqdn and the realm have been redacted replaced by redacted.

management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://sso.example.com/realms/example, previously configured value: https://sso.example.com/realms/example management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://sso.example.com/realms/example/protocol/openid-connect/certs, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/certs management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/token, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/token management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/auth, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/auth management-1 | 2024-06-28T12:13:23Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-06-28T12:13:23Z INFO management/server/store.go:128: using SQLite store engine management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-06-28T12:13:23Z INFO management/server/account.go:902: single account mode enabled, accounts number 1 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:292: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:324: management server version 0.28.3 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:325: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-06-28T12:13:33Z WARN management/server/account.go:942: failed warming up cache due to error: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unexpected EOF management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:34Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2969496814: GET /api/users status 401 management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:44Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1617532156: GET /api/groups status 401 management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:45Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 994037172: GET /api/peers status 401 management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1110047656: GET /api/users status 401 management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:20Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1610098238: GET /api/users status 401 management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1748801382: GET /api/users status 401 management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 884359798: GET /api/users status 401 management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:52Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1147169547: GET /api/users status 401 management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:08Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2964505694: GET /api/users status 401 management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:18Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2747264743: GET /api/users status 401 management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users/count?": unexpected EOF management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3841999307: GET /api/users status 401 management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:30Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3284690800: GET /api/users status 401 management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 620562561: GET /api/users status 401 management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3594267140: GET /api/users status 401 management-1 | 2024-06-28T12:15:53Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:04Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1882557009: GET /api/users status 401 management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 701924560: GET /api/users status 401

<!-- gh-comment-id:2196788418 --> @michelangelo136 commented on GitHub (Jun 28, 2024): I restarted the management service, these is the log, the fqdn and the realm have been redacted replaced by redacted. `management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:460: loaded OIDC configuration from the provided IDP configuration endpoint: https://sso.example.com/realms/example/.well-known/openid-configuration management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:462: overriding HttpConfig.AuthIssuer with a new value https://sso.example.com/realms/example, previously configured value: https://sso.example.com/realms/example management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:466: overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://sso.example.com/realms/example/protocol/openid-connect/certs, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/certs management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:492: overriding PKCEAuthorizationFlow.TokenEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/token, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/token management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:495: overriding PKCEAuthorizationFlow.AuthorizationEndpoint with a new value: https://sso.example.com/realms/example/protocol/openid-connect/auth, previously configured value: https://sso.example.com/realms/example/protocol/openid-connect/auth management-1 | 2024-06-28T12:13:23Z INFO management/server/telemetry/app_metrics.go:177: enabled application metrics and exposing on http://0.0.0.0:8081 management-1 | 2024-06-28T12:13:23Z INFO management/server/store.go:128: using SQLite store engine management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/server/migration/migration.go:130: No records in table peers, no migration needed management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:173: geo location service has been initialized from /var/lib/netbird/ management-1 | 2024-06-28T12:13:23Z INFO management/server/account.go:902: single account mode enabled, accounts number 1 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:292: running gRPC backward compatibility server: [::]:33073 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:324: management server version 0.28.3 management-1 | 2024-06-28T12:13:23Z INFO management/cmd/management.go:325: running HTTP server and gRPC server on the same port: [::]:443 management-1 | 2024-06-28T12:13:33Z WARN management/server/account.go:942: failed warming up cache due to error: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unexpected EOF management-1 | 2024-06-28T12:13:34Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:34Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2969496814: GET /api/users status 401 management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:44Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:44Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1617532156: GET /api/groups status 401 management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:13:45Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:45Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 994037172: GET /api/peers status 401 management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:13:55Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:13:55Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1110047656: GET /api/users status 401 management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:20Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:20Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1610098238: GET /api/users status 401 management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1748801382: GET /api/users status 401 management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 884359798: GET /api/users status 401 management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:14:52Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:14:52Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1147169547: GET /api/users status 401 management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:08Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:08Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2964505694: GET /api/users status 401 management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:18Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:18Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2747264743: GET /api/users status 401 management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users/count?": unexpected EOF management-1 | 2024-06-28T12:15:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3841999307: GET /api/users status 401 management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:30Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:30Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3284690800: GET /api/users status 401 management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Get "https://sso-admin.example.com:443/admin/realms/example/users?max=162": unexpected EOF management-1 | 2024-06-28T12:15:31Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:31Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 620562561: GET /api/users status 401 management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:15:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:15:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 3594267140: GET /api/users status 401 management-1 | 2024-06-28T12:15:53Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:04Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:04Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 1882557009: GET /api/users status 401 management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: context deadline exceeded (Client.Timeout or context cancellation while reading body) management-1 | 2024-06-28T12:16:19Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-28T12:16:19Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 701924560: GET /api/users status 401`
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Jul 1, 2024):

Hello @bcmmbaga, will you need other logs from the system or something from the management file?

<!-- gh-comment-id:2200252449 --> @michelangelo136 commented on GitHub (Jul 1, 2024): Hello @bcmmbaga, will you need other logs from the system or something from the management file?
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Jul 1, 2024):

@michelangelo136 There is an issue with the Keycloak LDAP federator becoming slow, causing timeouts when starting the management as we fetch the user list from Keycloak. Could you take a look at https://github.com/keycloak/keycloak/issues/10005? Also, please consider upgrading Keycloak and retesting to see if the issue has been resolved from their side.

<!-- gh-comment-id:2200404513 --> @bcmmbaga commented on GitHub (Jul 1, 2024): @michelangelo136 There is an issue with the Keycloak LDAP federator becoming slow, causing timeouts when starting the management as we fetch the user list from Keycloak. Could you take a look at https://github.com/keycloak/keycloak/issues/10005? Also, please consider upgrading Keycloak and retesting to see if the issue has been resolved from their side.
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Jul 2, 2024):

With the latest Keycloak version the problem still persists.

<!-- gh-comment-id:2202564365 --> @michelangelo136 commented on GitHub (Jul 2, 2024): With the latest Keycloak version the problem still persists.
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@relay2334 commented on GitHub (Jul 26, 2024):

Seeing the same issue still. Any recommendations?

<!-- gh-comment-id:2251922022 --> @relay2334 commented on GitHub (Jul 26, 2024): Seeing the same issue still. Any recommendations?
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@Marcus1Pierce commented on GitHub (Jul 26, 2024):

@relay2334 Try this comment https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043

<!-- gh-comment-id:2252225574 --> @Marcus1Pierce commented on GitHub (Jul 26, 2024): @relay2334 Try this comment https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@relay2334 commented on GitHub (Jul 29, 2024):

Unfortunately, no luck. Looks like its the Keycloak LDAP Issue

<!-- gh-comment-id:2256724161 --> @relay2334 commented on GitHub (Jul 29, 2024): Unfortunately, no luck. Looks like its the Keycloak LDAP Issue
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@paulDashkevich commented on GitHub (Aug 11, 2024):

@michelangelo136 hi
Initially, netbird didn't work for me with LDAPS federation. Solving for me is in the netbird kk-client settings (client and backend) I turned off the function:
Clients > netbird backend (and 2nd netbird-client) > Client scopes > netbird-backend-dedicated (and 2nd netbird-client-dedicated) > Scope ON > switch to OFF
image
After restart services of netbird - everything happened again
(
<!-- gh-comment-id:2282812367 --> @paulDashkevich commented on GitHub (Aug 11, 2024): @michelangelo136 hi Initially, netbird didn't work for me with LDAPS federation. Solving for me is in the netbird kk-client settings (client and backend) I turned off the function: `Clients > netbird backend (and 2nd netbird-client) > Client scopes > netbird-backend-dedicated (and 2nd netbird-client-dedicated) > Scope ON > switch to OFF` <img width="535" alt="image" src="https://github.com/user-attachments/assets/89a442d5-a4c4-435a-83d4-c06da0c62ddc"> After restart services of netbird - everything happened again : (
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Aug 11, 2024):

I followed a method mentioned above making an inter-realm authentication and having a separate netbird realm that authenticates on the primary one, I will try your method in the upcoming week, it will hopefully work nicely and won't cause an outage, hopefully this will help streamline the user authentication process.

Thanks for sharing!

<!-- gh-comment-id:2282824722 --> @michelangelo136 commented on GitHub (Aug 11, 2024): I followed a method mentioned above making an inter-realm authentication and having a separate netbird realm that authenticates on the primary one, I will try your method in the upcoming week, it will hopefully work nicely and won't cause an outage, hopefully this will help streamline the user authentication process. Thanks for sharing!
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (Aug 16, 2024):

@michelangelo136 Thanks your sharing. How did you make the "inter-realm" authentication work?
Let's say you have Realm A with LDAP and Realm B (without LDAP) for Netbird ? Did you configure in Realm B an "identity provider" of type "Keycloak OpenID" that points to Realm A or did you use another way?

<!-- gh-comment-id:2293658034 --> @cmacheret commented on GitHub (Aug 16, 2024): @michelangelo136 Thanks your sharing. How did you make the "inter-realm" authentication work? Let's say you have Realm A with LDAP and Realm B (without LDAP) for Netbird ? Did you configure in Realm B an "identity provider" of type "Keycloak OpenID" that points to Realm A or did you use another way?
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Aug 16, 2024):

@cmacheret yes that's how I did it, effectively the netbird realm authenticates using open id connect to the main realm.

I can look up the config on Monday and post it here as a lot of things are undocumented and you need to find how they work through trial and error.

<!-- gh-comment-id:2293768515 --> @michelangelo136 commented on GitHub (Aug 16, 2024): @cmacheret yes that's how I did it, effectively the netbird realm authenticates using open id connect to the main realm. I can look up the config on Monday and post it here as a lot of things are undocumented and you need to find how they work through trial and error.
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (Aug 17, 2024):

@michelangelo136 that would be great, thanks

<!-- gh-comment-id:2294808407 --> @cmacheret commented on GitHub (Aug 17, 2024): @michelangelo136 that would be great, thanks
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (Aug 21, 2024):

@michelangelo136 Hi, any chance you had time to check your config? It would be really great if you could share it. Thanks in advance!

<!-- gh-comment-id:2301342714 --> @cmacheret commented on GitHub (Aug 21, 2024): @michelangelo136 Hi, any chance you had time to check your config? It would be really great if you could share it. Thanks in advance!
saavagebueno commented 2026-08-05 00:57:27 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Aug 28, 2024):

Hi @cmacheret, sorry for the delay, quite a lot of stuff lately, in the Netbird Realm you need to go to Identity Providers and create a new Keycloak OpenID provider

Alias = Your provider name (write anything you want here)
Under the OpenID Connection Settings populate the metadata URLs based on the https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration contents (replace keycloak, example and example-realm with your own values)

Then set the following
Client authentication: Client secret sent as post
Client ID: "The client ID that you will create in your keycloak-example/prod realm"
Client Secret: "The secret taken from the client you created in your prod realm"
Client Assertion Signature Algorithm: "By default is ES256"
Send 'id_token_hint' in logout requests: On

Leave all of the other option to the "off" state.

Then, in your prod Realm create a new OpenID client and give it a name of your choice.
Client ID: Anything you would like
Root URL: Your keycloak - Netbird realm url, eg: https://keycloak.example.com/realms/netbird
Valid redirect URIs: You need to set the following values:

Then go to the Credentials Tab and set the Client Authenticator to "Client ID and Secret" and use generated secret to populate the Client Secret for the Identity Provider in the netbird Realm.

That should be what I did and it worked, hopefully, it work for you as well.

<!-- gh-comment-id:2314654387 --> @michelangelo136 commented on GitHub (Aug 28, 2024): Hi @cmacheret, sorry for the delay, quite a lot of stuff lately, in the Netbird Realm you need to go to **Identity Providers** and create a new **Keycloak OpenID provider** **Alias** = Your provider name (write anything you want here) Under the **OpenID Connection Settings** populate the metadata URLs based on the https://keycloak.example.com/realms/example-realm/.well-known/openid-configuration contents (replace keycloak, example and example-realm with your own values) Then set the following **Client authentication:** Client secret sent as post **Client ID:** "The client ID that you will create in your keycloak-example/prod realm" **Client Secret:** "The secret taken from the client you created in your prod realm" **Client Assertion Signature Algorithm:** "By default is ES256" **Send 'id_token_hint' in logout requests:** On Leave all of the other option to the "off" state. Then, in your prod Realm create a new OpenID client and give it a name of your choice. **Client ID:** Anything you would like **Root URL:** Your keycloak - Netbird realm url, eg: https://keycloak.example.com/realms/netbird **Valid redirect URIs:** You need to set the following values: - https://keycloak.example.com/* - https://keycloak.example.com/realms/netbird/broker/your-Client-ID/endpoint **Web Origins:** + **Client Authentication:** On **Authentication Flow:** Standard Flow, Direct Access grants Then go to the **Credentials** Tab and set the **Client Authenticator** to "Client ID and Secret" and use generated secret to populate the Client Secret for the Identity Provider in the netbird Realm. --- That should be what I did and it worked, hopefully, it work for you as well.
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (Aug 29, 2024):

Thanks a lot @michelangelo136

<!-- gh-comment-id:2317048907 --> @cmacheret commented on GitHub (Aug 29, 2024): Thanks a lot @michelangelo136
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @michelangelo136,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

<!-- gh-comment-id:2835658546 --> @nazarewk commented on GitHub (Apr 28, 2025): Hello @michelangelo136, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@michelangelo136 commented on GitHub (Apr 28, 2025):

Hello @nazarewk,
Unfortunately I don't have a test Netbird environment available in order to test it.

@cmacheret I'm tagging you in the off chance that you have a test environment available and you can test it.

<!-- gh-comment-id:2836907540 --> @michelangelo136 commented on GitHub (Apr 28, 2025): Hello @nazarewk, Unfortunately I don't have a test Netbird environment available in order to test it. @cmacheret I'm tagging you in the off chance that you have a test environment available and you can test it.
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (May 2, 2025):

Hi @michelangelo136 and @nazarewk
I don't have a test setup but should be able to get one running without too much effort. Will keep you posted.

<!-- gh-comment-id:2847097472 --> @cmacheret commented on GitHub (May 2, 2025): Hi @michelangelo136 and @nazarewk I don't have a test setup but should be able to get one running without too much effort. Will keep you posted.
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@cmacheret commented on GitHub (May 5, 2025):

Hi @nazarewk and @michelangelo136

the issue seems to be solved.

Here the details from my test environment :

Keycloak (running on docker) :
version : 26.2 (image: quay.io/keycloak/keycloak:26.2)
user federation : Active Directory on prem (Windows Server 2022) using LDAPS (port 636)

Netbird version :
dashboard : v2.11.0
all other components (management,signal, ...) : 0.43.1

I'm able to login the dashboard with my "federated" user coming from the Active Directory.

The next step would be now to check how to limit the login to some users with a specific Active Directory group (or a specific role in Keyclaok).

Best regards

<!-- gh-comment-id:2850424287 --> @cmacheret commented on GitHub (May 5, 2025): Hi @nazarewk and @michelangelo136 the issue seems to be solved. Here the details from my test environment : Keycloak (running on docker) : version : 26.2 (image: quay.io/keycloak/keycloak:26.2) user federation : Active Directory on prem (Windows Server 2022) using LDAPS (port 636) Netbird version : dashboard : v2.11.0 all other components (management,signal, ...) : 0.43.1 I'm able to login the dashboard with my "federated" user coming from the Active Directory. The next step would be now to check how to limit the login to some users with a specific Active Directory group (or a specific role in Keyclaok). Best regards
saavagebueno commented 2026-08-05 00:57:28 -04:00
Author
Owner
Copy Link

@Lirok228 commented on GitHub (Sep 11, 2025):

Subject: 401 Authentication Error and Timeout with LDAP Federation

I'm encountering a similar issue. I have configured LDAP federation in Keycloak, and I'm receiving a 401 error during authentication.

It appears that the authentication process is timing out, likely because we have a very large number of users in our Active Directory. It seems there is no option to configure this timeout.

I saw a suggestion in another issue to disable the "Full scope allowed" setting on the backend client, but this did not resolve the problem.

Netbird v0.56.1 (latest) (docker)
Keycloak v26.2.0 (on-prem)

Here is the full error log:

2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] management/server/http/middleware/auth_middleware.go:69: Error when validating JWT: context deadline exceeded (Client.Timeout or context cancellation while reading body)
2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] shared/management/http/util/util.go:85: got a handler error: token invalid
2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] management/server/http/middleware/auth_middleware.go:69: Error when validating JWT: context deadline exceeded (Client.Timeout or context cancellation while reading body)
2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] shared/management/http/util/util.go:85: got a handler error: token invalid
2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] management/server/telemetry/http_api_metrics.go:189: HTTP response 8051026d-b7ff-4100-8bbf-6cce1a953c46: GET /api/users/current status 401
2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] management/server/telemetry/http_api_metrics.go:189: HTTP response aef98b36-dddd-4f16-af09-6f36e9e9c607: GET /api/users status 401

<!-- gh-comment-id:3279118511 --> @Lirok228 commented on GitHub (Sep 11, 2025): Subject: 401 Authentication Error and Timeout with LDAP Federation I'm encountering a similar issue. I have configured LDAP federation in Keycloak, and I'm receiving a 401 error during authentication. It appears that the authentication process is timing out, likely because we have a very large number of users in our Active Directory. It seems there is no option to configure this timeout. I saw a suggestion in another issue to disable the "Full scope allowed" setting on the backend client, but this did not resolve the problem. Netbird v0.56.1 (latest) (docker) Keycloak v26.2.0 (on-prem) Here is the full error log: 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] management/server/http/middleware/auth_middleware.go:69: Error when validating JWT: context deadline exceeded (Client.Timeout or context cancellation while reading body) 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] shared/management/http/util/util.go:85: got a handler error: token invalid 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] management/server/http/middleware/auth_middleware.go:69: Error when validating JWT: context deadline exceeded (Client.Timeout or context cancellation while reading body) 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] shared/management/http/util/util.go:85: got a handler error: token invalid 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: 8051026d-b7ff-4100-8bbf-6cce1a953c46] management/server/telemetry/http_api_metrics.go:189: HTTP response 8051026d-b7ff-4100-8bbf-6cce1a953c46: GET /api/users/current status 401 2025-09-10T10:25:11Z ERRO [context: HTTP, requestID: aef98b36-dddd-4f16-af09-6f36e9e9c607] management/server/telemetry/http_api_metrics.go:189: HTTP response aef98b36-dddd-4f16-af09-6f36e9e9c607: GET /api/users status 401
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2021 Q4
2021 Q4
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
2022 Q1
accessibility
accessibility
accessibility
acl
acl
acl
agent
agent
agent
agent
agent
agent
Android
Android
Android
Android
Android
Android
api
api
api
authentik
authentik
authentik
automation
automation
automation
azure
azure
azure
battery-usage
battery-usage
battery-usage
bug
cache
cache
cache
client
client
client
client-ui
client-ui
client-ui
cloud
cloud
cloud
cloud-only
cloud-only
cloud-only
cloudflare
cloudflare
cloudflare
community
community
community
compatibility
compatibility
compatibility
config-idp
config-idp
config-idp
config-issue
config-issue
config-issue
connection
connection
connection
contribution
contribution
contribution
coturn
coturn
coturn
cross-vpn
cross-vpn
cross-vpn
dashboard
dashboard
dashboard
data-usage
data-usage
data-usage
distribution
distribution
distribution
dns
dns
dns
docker
docker
docker
documentation
documentation
documentation
duplicate
duplicate
duplicate
enhancement
enhancement
event-stream
event-stream
event-stream
feature-request
feature-request
feature-request
freebsd
freebsd
freebsd
getting-started
getting-started
getting-started
go
go
go
good first issue
good first issue
good first issue
gui
gui
gui
help wanted
help wanted
help wanted
home-assistant
home-assistant
home-assistant
idp
idp
idp
inconsistency
inconsistency
inconsistency
integration
integration
integration
integrations
integrations
integrations
ios
ios
ios
ipv6
ipv6
ipv6
jwt
jwt
jwt
k8s
k8s
k8s
keycloak
keycloak
keycloak
linux
linux
linux
login
login
login
macos
macos
macos
management-service
management-service
management-service
Medium
Medium
Medium
missing-docs
missing-docs
missing-docs
mobile
mobile
mobile
moved-internal
moved-internal
moved-internal
needs-review
needs-review
needs-review
netbird-ui
netbird-ui
netbird-ui
networking
networking
networking
new-platform
new-platform
new-platform
nginx
nginx
nginx
notification
notification
notification
okta
okta
okta
openwrt
openwrt
openwrt
P2
P2
P2
packaging
packaging
packaging
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
peer-management
performance
performance
performance
postgres
postgres
postgres
posture-checks
posture-checks
posture-checks
psk
psk
psk
pull-request
Mirrored from GitHub Pull Request
 question
question
question
refactor
refactor
refactor
relay
relay
relay
release
release
release
rfc
rfc
rfc
routes
routes
routes
security
security
security
security-improvement
security-improvement
security-improvement
security-related
security-related
security-related
self-hosting
self-hosting
self-hosting
server
server
server
signal
signal
signal
sleep-issue
sleep-issue
sleep-issue
ssh
ssh
ssh
ssl
ssl
ssl
status
status
status
store
store
store
synology
synology
synology
system-compatibility-issue
system-compatibility-issue
system-compatibility-issue
test-suite
test-suite
test-suite
third-party-integration
third-party-integration
third-party-integration
triage
triage
triage
triage
triage
triage
triage-needed
triage-needed
triage-needed
troubleshooting
troubleshooting
troubleshooting
UX
UX
UX
waiting-feedback
waiting-feedback
waiting-feedback
windows
windows
windows
wontfix
wontfix
wontfix
zitadel
zitadel
zitadel
No Label idp keycloak management-service self-hosting waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dynr-servers saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#4382
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?