[GH-ISSUE #2696] Dashboard stuck on loading after 0.29.4 > 0.30.0 update (Self-Hosted) if "JWT group sync" is enabled #5630

Open
opened 2026-08-05 01:04:17 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @florian-obradovic on GitHub (Oct 4, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2696

Originally assigned to: @bcmmbaga on GitHub.

Describe the problem
After
Dashboard stuck on loading after 0.29.4 > 0.30.0 update.
Slack: https://netbirdio.slack.com/archives/C05T5K65X7U/p1728077981790249

It works again, if I switch back to image: netbirdio/management:0.29.4 in dokcer-compose.yml.
I just upgraded to separate Netbird instances. One instance worked fine but my private one is stuck on loading the dashboard.

Both instances use Entra ID (AAD) as IDP!

# netbird_version_check.sh
MGMTCID=$(docker ps|grep management|awk ‘{print $1}’)
if [[ -z $MGMTCID ]] ; then
       echo No MGMT container found...
       exit 1
fi
nbversion=$(docker inspect $MGMTCID |grep “org.opencontainers.image.version”|awk -F: ‘{print $2}‘)
echo Server is running Netbird management version: $nbversion
DASHBOARDCID=$(docker ps|grep dashboard|awk ‘{print $1}’)
if [[ -z $DASHBOARDCID ]] ; then
       echo No MGMT container found...
       exit 1
fi
nbversion=$(docker inspect $DASHBOARDCID |grep “org.opencontainers.image.version”|awk -F: ‘{print $2}’)
echo Server is running Netbird dashboard version: $nbversion
Server is running Netbird management version:  “0.30.0”
Server is running Netbird dashboard version:  “v2.6.0"
dashboard-1   | 9.9.9.9 - - [04/Oct/2024:21:46:04 +0000] "GET /settings HTTP/1.1" 200 2107 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-"
management-1  | 2024-10-04T21:46:04Z ERRO [requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e, context: HTTP] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: context canceled
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e] management/server/http/util/util.go:81: got a handler error: token invalid
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e] management/server/telemetry/http_api_metrics.go:168: HTTP response c2adc7c8-33f6-4e5e-a111-433e31e2de7e: GET /api/users status 401
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/sql_store.go:433: error when getting account from the store: context canceled
management-1  | 2024-10-04T21:46:04Z ERRO [requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1, context: HTTP] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: issue getting account from store
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/http/util/util.go:81: got a handler error: token invalid
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/telemetry/http_api_metrics.go:168: HTTP response fcf93833-2c24-4572-ab2e-fd37333bddd1: GET /api/groups status 401
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: error getting user: issue getting user from store
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/http/util/util.go:81: got a handler error: token invalid
management-1  | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/telemetry/http_api_metrics.go:168: HTTP response 9feb2ce6-b786-4c0b-8171-403949d5fced: GET /api/accounts status 401

Screenshots

CleanShot 2024-10-04 at 23 39 18@2x

docker-compose.yml

#version: "3"
services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    #image: netbirdio/dashboard:v2.5.0
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.my-domain.com:33073
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.my-domain.com:33073
      # OIDC
      - AUTH_AUDIENCE=GUID-GUID
      - AUTH_CLIENT_ID=GUID-GUID
      - AUTH_CLIENT_SECRET=
      - AUTH_AUTHORITY=https://login.microsoftonline.com/c7af6c1f-aaad-4101-b8c3-0f7766597a62/v2.0
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://GUID-GUID/api
      - AUTH_REDIRECT_URI=/auth
      - AUTH_SILENT_REDIRECT_URI=/silent-auth
      - NETBIRD_TOKEN_SOURCE=idToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=netbird.my-domain.com
      - LETSENCRYPT_EMAIL=mec@my-domain.com
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10000:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "netbird.my-domain.com", "--log-file", "console"]

  # Management
  management:
    image: netbirdio/management:latest
    #image: netbirdio/management:0.29.4
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
    ports:
      - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "netbird.my-domain.com", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.my-domain.com",
      "--dns-domain=ivo"
      ]

  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    domainname: netbird.my-domain.com
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:
Originally created by @florian-obradovic on GitHub (Oct 4, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2696 Originally assigned to: @bcmmbaga on GitHub. **Describe the problem** After Dashboard stuck on loading after 0.29.4 > 0.30.0 update. Slack: https://netbirdio.slack.com/archives/C05T5K65X7U/p1728077981790249 It works again, if I switch back to image: netbirdio/management:0.29.4 in dokcer-compose.yml. I just upgraded to separate Netbird instances. One instance worked fine but my private one is stuck on loading the dashboard. Both instances use Entra ID (AAD) as IDP! ``` # netbird_version_check.sh MGMTCID=$(docker ps|grep management|awk ‘{print $1}’) if [[ -z $MGMTCID ]] ; then echo No MGMT container found... exit 1 fi nbversion=$(docker inspect $MGMTCID |grep “org.opencontainers.image.version”|awk -F: ‘{print $2}‘) echo Server is running Netbird management version: $nbversion DASHBOARDCID=$(docker ps|grep dashboard|awk ‘{print $1}’) if [[ -z $DASHBOARDCID ]] ; then echo No MGMT container found... exit 1 fi nbversion=$(docker inspect $DASHBOARDCID |grep “org.opencontainers.image.version”|awk -F: ‘{print $2}’) echo Server is running Netbird dashboard version: $nbversion Server is running Netbird management version: “0.30.0” Server is running Netbird dashboard version: “v2.6.0" ``` ``` dashboard-1 | 9.9.9.9 - - [04/Oct/2024:21:46:04 +0000] "GET /settings HTTP/1.1" 200 2107 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" management-1 | 2024-10-04T21:46:04Z ERRO [requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e, context: HTTP] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: context canceled management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e] management/server/http/util/util.go:81: got a handler error: token invalid management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: c2adc7c8-33f6-4e5e-a111-433e31e2de7e] management/server/telemetry/http_api_metrics.go:168: HTTP response c2adc7c8-33f6-4e5e-a111-433e31e2de7e: GET /api/users status 401 management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/sql_store.go:433: error when getting account from the store: context canceled management-1 | 2024-10-04T21:46:04Z ERRO [requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1, context: HTTP] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: issue getting account from store management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/http/util/util.go:81: got a handler error: token invalid management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: fcf93833-2c24-4572-ab2e-fd37333bddd1] management/server/telemetry/http_api_metrics.go:168: HTTP response fcf93833-2c24-4572-ab2e-fd37333bddd1: GET /api/groups status 401 management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: error getting user: issue getting user from store management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/http/util/util.go:81: got a handler error: token invalid management-1 | 2024-10-04T21:46:04Z ERRO [context: HTTP, requestID: 9feb2ce6-b786-4c0b-8171-403949d5fced] management/server/telemetry/http_api_metrics.go:168: HTTP response 9feb2ce6-b786-4c0b-8171-403949d5fced: GET /api/accounts status 401 ``` **Screenshots** ![CleanShot 2024-10-04 at 23 39 18@2x](https://github.com/user-attachments/assets/8145a6d6-8247-4fab-a977-3e3577495275) **docker-compose.yml** ``` #version: "3" services: #UI dashboard dashboard: image: netbirdio/dashboard:latest #image: netbirdio/dashboard:v2.5.0 restart: unless-stopped ports: - 80:80 - 443:443 environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.my-domain.com:33073 - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.my-domain.com:33073 # OIDC - AUTH_AUDIENCE=GUID-GUID - AUTH_CLIENT_ID=GUID-GUID - AUTH_CLIENT_SECRET= - AUTH_AUTHORITY=https://login.microsoftonline.com/c7af6c1f-aaad-4101-b8c3-0f7766597a62/v2.0 - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email offline_access User.Read api://GUID-GUID/api - AUTH_REDIRECT_URI=/auth - AUTH_SILENT_REDIRECT_URI=/silent-auth - NETBIRD_TOKEN_SOURCE=idToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN=netbird.my-domain.com - LETSENCRYPT_EMAIL=mec@my-domain.com volumes: - netbird-letsencrypt:/etc/letsencrypt/ # Signal signal: image: netbirdio/signal:latest restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "netbird.my-domain.com", "--log-file", "console"] # Management management: image: netbirdio/management:latest #image: netbirdio/management:0.29.4 restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "netbird.my-domain.com", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.my-domain.com", "--dns-domain=ivo" ] # Coturn coturn: image: coturn/coturn:latest restart: unless-stopped domainname: netbird.my-domain.com volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: ```
saavagebueno added the bugmanagement-servicejwt labels 2026-08-05 01:04:17 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#5630