Arch: Unable to read secrets

Forum|Forum|2 years ago
July 24, 2023
7 replies
644 views

I started by attempting to read a secret with regular secret reference format, copied out of the app and pasted into my .bashrc. However I get the following error:

[ERROR] 2023/07/24 05:23:54 could not read secret op://Lab/LabToken/credential: error initializing client: Validation: (failed to session.DecodeSACredentials), Server: (failed to DecodeSACCredentials), failed to parseToken, format is invalid

Interestingly enough I actually also get this error when attempting to run op whoami

❯ op whoami [ERROR] 2023/07/24 05:23:07 failed to DecodeSACCredentials: failed to parseToken, format is invalid

Not sure what's going on here, any help would be appreciated

1Password Version: 8.10.8
Extension Version: 2.11
OS Version: archlinux 6.4.4
Browser: Firefox

CLI

A

Anonymous

Hi @shahab96, that could happen if you have the environment variable OP_SERVICE_ACCOUNT set with an incorrect token.

Could you unset that environment variable, log into your account with op signin and then try whoami or the secret reference?

There's definitely scope for us to improve this messaging, so I'll track this internally. Thank you for surfacing this!

A

Anonymous

Hi @ArunV1P

I attempted unsetting the token, but it didn't make any difference. Both commands still fail with the same error.

Thanks!
Shahab

A

Anonymous

To confirm, did you sign into your 1Password account with op signin after unsetting the OP_SERVICE_ACCOUNT token?

A

Anonymous

Sorry, I missed that part. Running op signin did fix it. Thank you!

A

Anonymous

Glad that helped!

A

Anonymous

hi @ArunV1P i'm currently running into this while testing secrets automation. i unset that environment variable OP_SERVICE_ACCOUNT, quit terminal, reopened and logged into my account with op signin. but how can i successfully use OP_SERVICE_ACCOUNT as an env variable? thanks

A

Anonymous

Hi @click94, you can prefix the OP_SERVICE_ACCOUNT before your op CLI command like so:

OP_SERVICE_ACCOUNT=value op vault ls

Or, you can export OP_SERVICE_ACCOUNT=value and within the same shell session, run a op CLI command and it'd use the Service Account token.

I hope that helps, but feel free to followup if you have any questions! Preferably as a new forum topic if it's a long one. :)

Sign up

1Password employees: Sign in with SSO

Login to the community

1Password employees: Sign in with SSO

Scanning file for viruses.

This file cannot be downloaded