gcloud cli used to ask me to re-enter my password, now "Reauthentication failed"

[timhardy]

I am can no longer just re-enter my password, now I consistently get the following error...

There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution

What is up with this? Why does reauthentication ALWAYS fail? How can I get back to it just asking me to reenter my password?

I updated gcloud recently, and I added something for BigQuery. Tell me how to get more diag info, and I will gladly provide.

[JuatonCJ]

Hi @timhardy,

Welcome to Google Cloud Community! 

If a password is required for re-authentication in Cloud SDK, you must execute the ‘gcloud auth login’ command to renew the session. This action will open a browser window, directing the user to the Identity Provider (IdP), where  you may enter the credentials if there is no active session. It’s advisable to re-authenticate each time your session expires.

Additionally, for updates related to BigQuery, please refer to the following documentations:

•  Authenticate to BigQuery
• Get started with authentication | Bigquery.

    I hope the above information is helpful.

[timhardy]

Until just a few days ago. When I'd open up my laptop and type "kubectl get pods" on my command line, I'd get a line right under it that said something really close to "you have to re-enter your password". I'd type my password right there, and I'd be good to go for the whole day.

What changed? It now requires me to do a full auth with my browser, when that auth is supposed to put a credential on my machine that I can easily refresh. I'm pretty sure the process is not supposed to work as you describe. "gcloud auth login" manipulates my .kube/config file. It's supposed to give me an easy way to refresh my already configured login, not force me to rewrite that configuration every single day.

Your answer also doesn't explain why I'm receiving the error below. Of particular note is the "There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution." Why can't it prompt? What is "non-interactive" about my execution? I'm running in a console. The process is designed to easily refresh auth tokens, which it used to do, but it is now failing.

E1023 11:37:08.315582 48520 memcache.go:265] couldn't get current server API group list: Get "https://34.45.130.82/api?timeout=32s": getting credentials: exec: executable gke-gcloud-auth-plugin.exe failed with exit code 1
F1023 11:37:09.279246 35024 cred.go:145] print credential failed with error: Failed to retrieve access token:: failure while executing gcloud, with args [config config-helper --format=json]: exit status 1 (err: ERROR: (gcloud.config.config-helper) There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution.

[timhardy]

After further research, I'm wondering whether your statement, "If a password is required for re-authentication in Cloud SDK, you must execute the 'gcloud auth login' command to renew the session" is accurate. 

The gCloud auth process uses OAuth2 Code Flow...

• After running "gcloud auth login" and successfully performing a credential swap via the browser and consenting, Google returns an authorization code back to the CLI.
• The CLI then uses this authorization code to exchange for an access token and a refresh token  
• Access Token: This token is used for immediate API requests. It has a short lifespan.
• Refresh Token: This token allows the CLI to get new access tokens when the old one expires, without needing to re-authenticate through the browser.
• The credentials are typically stored in the user's home directory under .config/gcloud/ in a file named credentials.

The error message, "There was a problem refreshing your current auth tokens: Reauthentication failed. cannot prompt during non-interactive execution." indicates that it appears to be designed to not have to do the full browser cred swap with consent every single day. It appears to be failing and not operating as intended. Indeed, it did not  operate that way - requiring a browser cred swap and full consent question every single day - a little over a week ago.

Can we get someone else to weigh in, please?