Hi,
we are using ELK 7.9.3 with SG 4.7.3.0
I have some errors from one of signals active tenants.
This error is not on all active watches in this tenant. Just on a few.
What could be the reason?
Error while verifying internal auth token: tokenxxxxxx
pi_REDIS-6002_warn.2aa1a9225f74489101c1c643eef0027a1ec6c7b1296ccc4d511a0ceab1fd70b9
org.apache.cxf.rs.security.jose.jwt.JwtException: Internal auth token does not allow audience: pi_REDIS-6002_warn.2aa1a9225f74489101c1c643eef0027a1ec6c7b1296ccc4d511a0ceab1fd70b9
Allowed audiences: [pi_REDIS-6002_warn.2f01db79cc4a958c16788073c67af5c72875d4603ec07d3e285dbd5eb59d6f47]
at com.floragunn.searchguard.internalauthtoken.InternalAuthTokenProvider.validateAudience(InternalAuthTokenProvider.java:221) ~[search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.internalauthtoken.InternalAuthTokenProvider.validateClaims(InternalAuthTokenProvider.java:208) ~[search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.internalauthtoken.InternalAuthTokenProvider.getVerifiedJwtToken(InternalAuthTokenProvider.java:193) ~[search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.internalauthtoken.InternalAuthTokenProvider.userAuthFromToken(InternalAuthTokenProvider.java:106) [search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.internalauthtoken.InternalAuthTokenProvider.userAuthFromToken(InternalAuthTokenProvider.java:101) [search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.filter.SearchGuardFilter.apply0(SearchGuardFilter.java:147) [search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:119) [search-guard-suite-security-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:177) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:155) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:83) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.client.node.NodeClient.executeLocally(NodeClient.java:83) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:72) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:409) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:398) [elasticsearch-7.9.3.jar:7.9.3]
at org.elasticsearch.client.support.AbstractClient.search(AbstractClient.java:537) [elasticsearch-7.9.3.jar:7.9.3]
at com.floragunn.signals.watch.checks.AbstractSearchInput.executeSearchRequest(AbstractSearchInput.java:94) [search-guard-suite-signals-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.signals.watch.checks.AbstractSearchInput.execute(AbstractSearchInput.java:84) [search-guard-suite-signals-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.signals.execution.WatchRunner.executeChecks(WatchRunner.java:220) [search-guard-suite-signals-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.signals.execution.WatchRunner.execute(WatchRunner.java:152) [search-guard-suite-signals-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.signals.execution.WatchRunner.execute(WatchRunner.java:126) [search-guard-suite-signals-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at com.floragunn.searchsupport.jobs.execution.AuthorizingJobDecorator.execute(AuthorizingJobDecorator.java:37) [search-guard-suite-scheduler-7.9.3-47.3.0.jar:7.9.3-47.3.0]
at org.quartz.core.JobRunShell.run(JobRunShell.java:202) [quartz-2.3.2.jar:?]
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:573) [quartz-2.3.2.jar:?]