invalid_grant

[lechen26]

Hi

we are using google service account to access cloud stoage on one of our python projects.

nothing has changes on the service account we are using but recently we've started to see this intermittent error:

google.auth.exceptions.RefreshError: ('invalid_grant: Invalid JWT Signature.', '{"error":"invalid_grant","error_description":"Invalid JWT Signature."}')

it does not happen all the time but from time to time. like it failed to refresh the token but i dont understand why.
what can be the reason for this?

thanks
CL

[frankyn]

Hi @lechen26,

Thanks for filing the issue.
This is a duplicate of #17, which is being looked at here: googleapis/google-auth-library-python#261

[fcollman]

I don't think this is the same error, the exception looks different. We are also experiencing the same error, again on code that did not change, only upgrades to underlying google packages.

The exception listed in this isssue..

google.auth.exceptions.RefreshError: ('invalid_grant: Invalid JWT Signature.', '{"error":"invalid_grant","error_description":"Invalid JWT Signature."}')

The exception listed in #17

google.auth.exceptions.RefreshError: ('invalid_grant: reauth related error (rapt_required)', '{\n  "error": "invalid_grant",\n  "error_description": "reauth related error (rapt_required)",\n  "error_subtype": "rapt_required"\n}')

[fcollman]

I think this issue is actually covered here
googleapis/google-auth-library-python#667

and might be related to this underlying RSA issue
sybrenstuvel/python-rsa#173

[frankyn]

Ah, good call out, my mistake. let's reopen to keep track

[lechen26]

thanks @fcollman , exactly , we havent changed anything except we've upgraded our cluster.
i saw the RSA issue, but to be honest i wasnt sure its related as we are not using this package.

is this something the google-cloud-storage using?

thanks

[lechen26]

i've checked with pipdeptree its indeed the case.
thanks!

[busunkim96]

Just to make things explicit, if you're running into this please explicitly pin to rsa==4.6 in your requirements.txt.

For context, google-cloud-storage depends on google-auth which depends on rsa.

[tritone]

Thanks for clarifying @busunkim96 -- I'll go ahead and close this issue.