Returns "invalid credentials" error while trying to refresh an invalid macaroon

[Sebastien Bacher]

Using snapd 2.31.1 on bionic, that installation seems to have an invalid store macaroon which leads snapd to fail to work. It would be useful to at least hint the user how to get out of this situation (snap logout/login?)

$ snap install gnome-chess
erreur : cannot perform the following tasks:
- Download snap "gnome-chess" (17) from channel "stable" (invalid credentials)

Corresponding debug snapd log (SNAPD_DEBUG_HTTP=7)

snapd[7580]: 2018/03/08 12:27:08.540583 logger.go:76: DEBUG: < "HTTP/1.1 401 UNAUTHORIZED\r\nContent-Length: 125\r\nContent-Type: application/json\r\nDate: Thu, 08 Mar 2018 11:27:08 GMT\r\nServer: gunicorn/19.7.1\r\nWww-Authenticate: Macaroon needs_refresh=1\r\nX-Request-Id: 640e16db-b518-47ed-a2b3-08feedbe4e7f\r\nX-Vcs-Revision: 6e60d16\r\n\r\n"
snapd[7580]: 2018/03/08 12:27:08.540761 retry.go:40: DEBUG: Retrying https://login.ubuntu.com/api/v2/tokens/refresh, attempt 1, elapsed time=12.894µs
snapd[7580]: 2018/03/08 12:27:08.541289 logger.go:69: DEBUG: > "POST /api/v2/tokens/refresh HTTP/1.1\r\nHost: login.ubuntu.com\r\nUser-Agent: snapd/2.31.1+18.04 (series 16; classic) ubuntu/18.04 (amd64) linux/4.15.0-10-generic\r\nContent-Length: 1168\r\nAccept: application/json\r\nContent-Type: application/json\r\nAccept-Encoding: gzip\r\n\r\n{\"discharge_macaroon\":\"REPLACEDTEXT\"}"
snapd[7580]: 2018/03/08 12:27:08.723326 logger.go:76: DEBUG: < "HTTP/1.1 401 UNAUTHORIZED\r\nTransfer-Encoding: chunked\r\nContent-Language: en\r\nContent-Type: application/json; charset=utf-8\r\nDate: Thu, 08 Mar 2018 11:27:08 GMT\r\nServer: gunicorn/19.3.0\r\nStrict-Transport-Security: max-age=15768000; includeSubDomains; preload\r\nVary: Accept,Authorization,Accept-Language,Cookie\r\nX-Bzr-Revision-Number: 1599\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-Request-Id: WqEeDH8AAQEAAH4P75YAAACE1\r\nX-Xss-Protection: 1; mode=block\r\n\r\nc9\r\n{\"error_list\": [{\"message\": \"Provided email/password is not correct.\", \"code\": \"invalid-credentials\"}], \"message\": \"Provided email/password is not correct.\", \"code\": \"INVALID_CREDENTIALS\", \"extra\": {}}\r\n0\r\n\r\n"
snapd[7580]: 2018/03/08 12:27:08.723531 retry.go:52: DEBUG: The retry loop for https://login.ubuntu.com/api/v2/tokens/refresh finished after 1 retries, elapsed time=182.786609ms, status: 401
snapd[7580]: 2018/03/08 12:27:08.723827 task.go:303: DEBUG: 2018-03-08T12:27:08+01:00 ERROR invalid credentials

[Paweł Stołowski (stolowski)]

I cannot provoke any such error (by deliberately breaking my macaroon, or even removing it). Unclear how to reporduce, given that this bug is old it's quite possible the problem was fixed or was a temporary issue with the store. Closing on that basis.

[Konrad Zemek (kzemek)]

While I have no idea how I got to this state, I'm having the same problem. The ~/snap/.auth.json file is not broken, and snap logout/login does nothing to help (even though login proceeds successfully). Additionally, I keep having problems logging into Ubuntu One which only seems to be (temporarily) solved by resetting password, so maybe it's possible there's some problem with the server-side state of the account?

$ snap login
Personal information is handled as per our privacy notice at
https://www.ubuntu.com/legal/dataprivacy/snap-store

Email address: ******
Password of "******":
Login successful
$ snap refresh
error: cannot perform the following tasks:
- Download snap "vscode" (69) from channel "stable" (invalid credentials)

[Konrad Zemek (kzemek)]

Stopping snapd, removing /var/lib/snapd/state.json and restarting snapd did fix the issue - of course at the cost of losing snapd state. https://forum.snapcraft.io/t/handling-invalid-credentials-password-change-blocking-macaroon-refresh/2526/4 seems relevant

[John Lenton (chipaca)]

Konrad, did you keep a copy of the old state.json?

[Mateusz Mikuła (mati865)]

Reinstalling broken snap also helps. In my case:

$ snap refresh
- Download snap "spotify" (30) from channel "stable" (invalid credentials)

Running `snap remove spotify` and then `snap install spotify` solved the issue.

FWIW I kept backup of state.json

[Ondrej Kubik (ondrak)]

I have machine in this state now
It does not refresh any snaps or install any new ones
interestingly, when I deleted .snap/auth.json if fixed things half way
now I can install new snap (ubuntu-image), refresh snapcraft snap
but refreshing core and core18 returns again (invalid credentials)
snap version 2.39.3
Ubuntu 18.04.2
What I noticed when I try to refresh, I get pop up window with password request

[omid.1985 (omid-1985)]

To replicate this issue, make sure you had at least one update available for one of your snap package, then go to the Ubuntu.com and change your Ubuntu user password! Head back to the terminal and type "snap refresh". You get "invalid credentials" error for any packages that you had installed before the password change. Also all feature updates for packages you had before changing your password give you the same error.
Unfortunately, the only way to fix it for me was to remove all snap package and reinstall it again.
Also, snap logout and snap login after password change does not change anything. You still get "invalid credentials" for all the feature packages updates you had installed before changing your Ubuntu password.
Also, your removing /var/lib/snapd/state.json give you false "All snaps up to date."

[Farab (farabf33)]

I found the solution accidentally:

1- log out of snap:

#snap logout

2- Go to Settings --> Online Accounts and delete all accounts you have.

3- Now simply:

#snap refresh

[David Robert Lewis (ubuntupunk)]

Thanks for this Farab, your solution worked for me.