Authentication failed

[paulkaefer]

I just tried running the cs_tools tools searchable commands I'm running weekly, and got the following (email address redacted):

[10:09:13] Checking cluster configuration prod                    _config.py:207
           Logging into ThoughtSpot as p*******@<EMAIL>.com    _config.py:210
╭───────────── Authentication failed for p*******@<EMAIL>.com ──────────────╮
│                                                                              │
│ Authentication token of type  could not be authenticated by any configured   │
│ realms.  Please ensure that at least one realm can authenticate these        │
│ tokens.                                                                      │
│                                                                              │
│ CS Tools config: prod                                                        │
│     Incident ID: 6645d9b0-937a-4fe6-828c-c94b280d2598                        │
╰──────────────────────────────────────────────────────────────────────────────╯

How do I re-authenticate? I tried cs_tools config check --config prod but got the same output.

[boonhapus]

Hey @paulkaefer , did your config ever work? Typically this error means that either your password (in the config) is wrong, or that your user's username does not end with one of the whitelisted email domains.

Can you try logging into your ThoughtSpot cluster manually with the same credentials?

If your login page auto-redirects, you use..

https://my.thoughtspot.cloud/?disableAutoSAMLRedirect=true

..to force the login page to show.

Finally, one other thing to consider is that some terminals will automagically expand certain characters (typically $ and ! ). This is a behavior of the shell/terminal, and it happens prior to command execution. If your password contains one of those, you might need to change it.

[paulkaefer]

@boonhapus OK, I'm able to log in via our custom URL using the sso option. But I have disable_sso = true in my cs_tools config...

[boonhapus]

I see @paulkaefer . Today, CS Tools requires username/password of the user created within ThoughtSpot. In 1.5.0 (coming after the holidays), we'll support username/password or trusted authentication.. but brokering the SAML or OIDC handshake is a ton of work and I'm not keen on trying to support all the different flavors of SAML out there ha ha.

Is it feasible to create a service account user in your ThoughtSpot Admin page, and use that User for your configuration?

[paulkaefer]

@boonhapus thanks -- we were wondering if I might have to switch back to a local user. The service account is another good option. I'll have that discussion internally. I think this can be closed!

[paulkaefer]

FYI @boonhapus we created a service account & I'm able to resume my weekly exports.

[boonhapus]

Excellent @paulkaefer ! I'm working on the 1.5.0 release currently (expecting it in January sometime), and we will support two additional authentication mechanisms.

1/ Trusted Authentication
Generate a secret key which allows you to log in as any user. Available only to ThoughtSpot administrators via the Developer tab in the web interface.

2/ Bearer Token authentication
Generate a long-lived token, scoped to a single user.

This should give more flexibility for customers who want to turn off the local authentication option in ThoughtSpot or use their own user.

You can read about them both in the V2.0 API Documentation.