coop-cloud/outline
1
0
Fork 2
generated from coop-cloud/example
Code Issues 8 Pull Requests Projects Releases Wiki Activity

SECRET_KEY is generated with incorrect length #12

New Issue
Open
opened 2023-04-22 22:19:34 +00:00 by 3wordchant · 6 comments
3wordchant commented 2023-04-22 22:19:34 +00:00
Owner
Copy Link

Steps to reproduce:

  1. abra app new outline
  2. (enable SSO)
  3. abra app deploy outline
  4. Try to log in

Expected:

  • Works!

Actual:

  • Sent back to login screen, error in logs: �2023-04-22T00:11:09.611179000Z {"error":"Invalid key length","stack":"UnauthorizedError: Invalid key length\n at AuthenticationError (/opt/outline/build/server/errors.js:38:34)\n at accountProvisioner (/opt/outline/build/server/commands/accountProvisioner.js:118:43)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)","level":"error","message":"Error during authentication"}

This seems to be because SECRET_KEY should be 32 characters, but abra generates a 64-character secret. Maybe changing to length=32 is enough?

Steps to reproduce: 1. `abra app new outline` 2. (enable SSO) 3. `abra app deploy outline` 4. Try to log in Expected: - Works! Actual: - Sent back to login screen, error in logs: `�2023-04-22T00:11:09.611179000Z {"error":"Invalid key length","stack":"UnauthorizedError: Invalid key length\n at AuthenticationError (/opt/outline/build/server/errors.js:38:34)\n at accountProvisioner (/opt/outline/build/server/commands/accountProvisioner.js:118:43)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)","level":"error","message":"Error during authentication"}` This seems to be because SECRET_KEY should be 32 characters, but abra generates a 64-character secret. Maybe changing to `length=32` is enough?
👍 2
iexos commented 2023-05-10 10:34:06 +00:00
Owner
Copy Link

Changing secret_key to length 32 doesn't solve the problem for me, I still get the exact same error msg.
I also tried length=16, then I got:

{"level":"warn","message":"- SECRET_KEY's byte length must fall into (32, 64) range"}

So I guess the length of secret_key is not the issue.

Changing `secret_key` to length 32 doesn't solve the problem for me, I still get the exact same error msg. I also tried length=16, then I got: ``` {"level":"warn","message":"- SECRET_KEY's byte length must fall into (32, 64) range"} ``` So I guess the length of secret_key is not the issue.
3wordchant commented 2023-05-10 16:53:30 +00:00
Author
Owner
Copy Link

@iexos maybe you tried already, but you'd need to regenerate secrets (abra app secret rm ..., abra app secret generate ...) after changing this, and possibly also drop volumes (abra app volume rm -A ...).

Are you able to check what the current length of the secret key is, e.g. abra app run <domain> app cat /run/secrets/secret_key | wc -c?

@iexos maybe you tried already, but you'd need to regenerate secrets (`abra app secret rm ...`, `abra app secret generate ...`) after changing this, and possibly also drop volumes (`abra app volume rm -A ...`). Are you able to check what the current length of the secret key is, e.g. `abra app run <domain> app cat /run/secrets/secret_key | wc -c`?
iexos commented 2023-05-10 21:34:34 +00:00
Owner
Copy Link

Yes i did remove and regenerate with different key sizes, and also completely removed the app. Just tried now again:

> abra app run <domain> app cat /run/secrets/secret_key | wc -c
32

Also tried reducing the utils_secret to 32 chars and upgrading to newest image outlinewiki/outline:0.69.2, no change.

I'm using Authentik, maybe this is about some key that is returned? I also tried changing the key sizes within Authentik provider, no change.

Yes i did remove and regenerate with different key sizes, and also completely removed the app. Just tried now again: ``` > abra app run <domain> app cat /run/secrets/secret_key | wc -c 32 ``` Also tried reducing the utils_secret to 32 chars and upgrading to newest image `outlinewiki/outline:0.69.2`, no change. I'm using Authentik, maybe this is about some key that is returned? I also tried changing the key sizes within Authentik provider, no change.
iexos commented 2023-05-11 12:54:19 +00:00
Owner
Copy Link

Got it to work now. SECRET_KEY has to be in hex format, i.e. like openssl rand -hex 32. Can abra do that?

Got it to work now. `SECRET_KEY` has to be in hex format, i.e. like `openssl rand -hex 32`. Can `abra` do that?
3wordchant commented 2023-07-08 20:35:04 +00:00
Author
Owner
Copy Link

Ah great call, yes, that rings a bell. No, I think abra's current secret generation only does alphanumeric secrets - race you to a feature request in coop-cloud/organising

Ah great call, yes, that rings a bell. No, I think abra's current secret generation only does alphanumeric secrets - race you to a feature request in coop-cloud/organising
3wordchant commented 2025-06-24 10:17:09 +00:00
Author
Owner
Copy Link

Looks like this is implemented now, shall we try it out? toolshed/organising#614

Looks like this is implemented now, shall we try it out? toolshed/organising#614
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
3wordchant aadil abra-bot ammaratef45 Apfelwurm appletalk arjan basebuilder Brooke carla cas codegod100 coopcloud decentral1se fauno flancian Frando iexos javielico kawaiipunk knoflook lambdabundesverband mac-chaffee marlon mayel mirsal moritz nicksellen notplants p4u1 pau renovate-bot rix sef simon stevensting tobias trav val virtualboys wolcen wykwit xynosis yksflip
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: coop-cloud/outline#12
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?