[GH-ISSUE #3281] management api randomly dropping roles from accounts table locking me out (google workspace) #7047

Open
opened 2026-08-05 01:11:21 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @rgdev on GitHub (Feb 4, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/3281

Describe the problem

After updating from 0.34.1 to 0.36.5 the UI became unusable as I keep getting locked out. It works for a little while, I can move around and load pages and suddenly I'm no longer owner (or admin) & become user so I get 403 errors and am presented with the "Add new device to your network" page. Only way to fix it is to go into pg and manually change my role back.

Mangement is running with those args :

            - "--port"
            - "80"
            - "--log-file"
            - "console"
            - "--log-level"
            - "info"
            - "--disable-anonymous-metrics=true"
            - "--single-account-mode-domain=mydomain.com"
            - "--dns-domain=mydomain.com"
            - "--idp-sign-key-refresh-enabled"

Config looks like this :

{
  // relay, turn, signal, stun, reverse proxy config skipped for readability
  "HttpConfig": {
    "Address": "0.0.0.0:80",
    "AuthIssuer": "https://accounts.google.com",
    "AuthAudience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
    "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs",
    "AuthUserIDClaim": "sub",
    "CertFile": "",
    "CertKey": "",
    "IdpSignKeyRefreshEnabled": false,
    "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration"
  },
  "IdpManagerConfig": {
    "ManagerType": "none",
    "ClientConfig": {
      "Issuer": "https://accounts.google.com",
      "TokenEndpoint": "https://oauth2.googleapis.com/token",
      "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "ClientSecret": "xxxxxxxxxxxxxxx",
      "GrantType": "client_credentials"
    },
    "ExtraConfig": {
      "CustomerId": "xxxxxxxxxxxxxxx",
      "ServiceAccountKey": "xxxxxxxxxxxxxxx"
    },
    "Auth0ClientCredentials": null,
    "AzureClientCredentials": null,
    "KeycloakClientCredentials": null,
    "ZitadelClientCredentials": null
  },
  "DeviceAuthorizationFlow": {
    "Provider": "none",
    "ProviderConfig": {
      "Audience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "AuthorizationEndpoint": "",
      "Domain": "",
      "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "ClientSecret": "",
      "TokenEndpoint": "https://oauth2.googleapis.com/token",
      "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code",
      "Scope": "openid",
      "UseIDToken": true,
      "RedirectURLs": null
    }
  },
  "PKCEAuthorizationFlow": {
    "ProviderConfig": {
      "Audience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com",
      "ClientSecret": "xxxxxxxxxxxxxxx",
      "Domain": "",
      "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
      "TokenEndpoint": "https://oauth2.googleapis.com/token",
      "Scope": "openid profile email",
      "RedirectURLs": [
        "http://localhost:53000/",
        "http://localhost:54000/",
        "https://mydomain.com/auth",
        "https://mydomain.com/silent-auth"
      ],
      "UseIDToken": true
    }
  }
}

To Reproduce

Steps to reproduce the behavior:

Deploy 0.36.5 with google workspace idp

Expected behavior

Mangement shouldn't turn admin and owner roles into user role.

Are you using NetBird Cloud?

Self Hosted

NetBird version

0.36.5

Screenshots

accounts table showing me as owner :

Image

Later on, my role dropped and i'm now a user :

Image

Additional context

Add any other context about the problem here.

Originally created by @rgdev on GitHub (Feb 4, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/3281 **Describe the problem** After updating from 0.34.1 to 0.36.5 the UI became unusable as I keep getting locked out. It works for a little while, I can move around and load pages and suddenly I'm no longer owner (or admin) & become user so I get 403 errors and am presented with the "Add new device to your network" page. Only way to fix it is to go into pg and manually change my role back. Mangement is running with those args : ``` - "--port" - "80" - "--log-file" - "console" - "--log-level" - "info" - "--disable-anonymous-metrics=true" - "--single-account-mode-domain=mydomain.com" - "--dns-domain=mydomain.com" - "--idp-sign-key-refresh-enabled" ``` Config looks like this : ``` { // relay, turn, signal, stun, reverse proxy config skipped for readability "HttpConfig": { "Address": "0.0.0.0:80", "AuthIssuer": "https://accounts.google.com", "AuthAudience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs", "AuthUserIDClaim": "sub", "CertFile": "", "CertKey": "", "IdpSignKeyRefreshEnabled": false, "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration" }, "IdpManagerConfig": { "ManagerType": "none", "ClientConfig": { "Issuer": "https://accounts.google.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "ClientSecret": "xxxxxxxxxxxxxxx", "GrantType": "client_credentials" }, "ExtraConfig": { "CustomerId": "xxxxxxxxxxxxxxx", "ServiceAccountKey": "xxxxxxxxxxxxxxx" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "Audience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "AuthorizationEndpoint": "", "Domain": "", "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "ClientSecret": "", "TokenEndpoint": "https://oauth2.googleapis.com/token", "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code", "Scope": "openid", "UseIDToken": true, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "ClientID": "xxxxxxxxxxxxxxx.apps.googleusercontent.com", "ClientSecret": "xxxxxxxxxxxxxxx", "Domain": "", "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth", "TokenEndpoint": "https://oauth2.googleapis.com/token", "Scope": "openid profile email", "RedirectURLs": [ "http://localhost:53000/", "http://localhost:54000/", "https://mydomain.com/auth", "https://mydomain.com/silent-auth" ], "UseIDToken": true } } } ``` **To Reproduce** Steps to reproduce the behavior: Deploy 0.36.5 with google workspace idp **Expected behavior** Mangement shouldn't turn admin and owner roles into user role. **Are you using NetBird Cloud?** Self Hosted **NetBird version** 0.36.5 **Screenshots** accounts table showing me as owner : <img width="1082" alt="Image" src="https://github.com/user-attachments/assets/04a40bd1-a548-4b3b-8f6f-37dee1afc819" /> Later on, my role dropped and i'm now a user : <img width="1081" alt="Image" src="https://github.com/user-attachments/assets/9e859417-d9b9-4726-93e7-9ec6935e5efd" /> **Additional context** Add any other context about the problem here.
saavagebueno added the bugmanagement-serviceself-hostingpostgres labels 2026-08-05 01:11:21 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#7047