Signing up with an invitation requires JWT Auth Plugin to be disabled

[luzzardik]

Hi, whilst trying to make a colleague sign up to Passbolt after an invitation, they couldn't finish the process unless I disabled the JWT Authentication plugin through my Docker Compose file env variables.

This disables the Mobile app too, needing everyone to reimport their account kits.

[stripthis]

Hello,

"they couldn't finish the process unless I disabled the JWT Authentication plugin through my Docker Compose file env variables"

This is not a normal behavior, as JWT Authentication is not used in the sign up process. What was the error/troubleshooting steps leading you to this?

This is the first time we're hearing about such report, most likely this is a configuration issue, in which case it is better to open an issue on the community forum: https://community.passbolt.com . Waiting for more details to confirm this is a bug.

Best,

[luzzardik]

Hi,

I've invited my colleague through the Users Management, once she made her account (public key available on the users management view), she was redirected to a page with "The route /auth/login is not permitted with JWT authentication".

We've done this three times, fourth time, before she started the process, I disabled the JWT Auth plugin, and it worked.

It could be a config issue, but all health checks are passing, so I don't know where to look at.

[stripthis]

Hello, it's just for this user or all users? What browser is your colleague using? Are they using the official passbolt browser extension?

Could it be that they are already logged in, via another user account on the same domain? or another user on another domain?

[luzzardik]

Hi, this seems to occurs to all new users since our upgrade to the latest version of Passbolt, and this behavior is repeated across browsers (Chromium based, Safari and Firefox).

We've tested, as was the situation of our colleague, with a clean browser with the official browser extension (force installed by our Google Workspace configuration, as well as a manual installation).

They weren't logged in on any other account.