Identity errors

Causes and remedies for the error codes raised when roles and permissions are changed.

`error.identity.group_exists`

Text in the console: A group named {group} exists already.
Meaning for API clients: A local group with that name exists (names are compared without regard to case).
Code: ALREADY_EXISTS, HTTP 409

Argument	What it holds
`group`	the name that is taken.

Cause. A local group with that name exists already. Group names are compared without regard to case, so Ops and ops are the same group.

Remedy.

Use the existing group: kyvernon users groups get <name>.
Or choose another name.

`error.identity.group_not_found`

Text in the console: There is no group named {group}.
Meaning for API clients: No local group has that name.
Code: NOT_FOUND, HTTP 404

Argument	What it holds
`group`	the name that was asked for.

Cause. No local group has that name. The group may have been renamed or deleted.

Remedy.

List the groups: kyvernon users groups list.
Use the current name of the group.

`error.identity.group_cycle`

Text in the console: Group {member} cannot be nested in {group}: a group would contain itself, or the nesting would be deeper than eight levels.
Meaning for API clients: Nesting member in group would make a group contain itself, or nest deeper than eight levels.
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`group`	the group that would receive the member.
`member`	the group that would be nested.

Cause. A group would become a member of itself: directly, or through the groups nested in it. Nesting is also limited to eight levels.

Remedy.

Look at the nesting: kyvernon users groups get <name> shows the nested groups and the groups it is a member of.
Nest the groups the other way round, or remove a level of nesting with kyvernon users groups remove-group <name> <member>.

`error.identity.oidc_unreachable`

Text in the console: The identity provider at {issuer} did not answer. The settings were not changed.
Meaning for API clients: The identity provider did not answer OpenID Connect discovery at issuer; the stored provider is unchanged.
Code: FAILED_PRECONDITION, HTTP 412

Argument	What it holds
`issuer`	the issuer URL that did not answer.

Cause. Before an identity provider is stored, the controller reads the provider's discovery document (<issuer>/.well-known/openid-configuration). It got no valid answer, so the stored settings did not change.

Remedy.

Check the issuer URL: it is the address the provider names as its issuer, without /.well-known/....
Check that the controller reaches the provider (DNS, firewall, proxy) and trusts its TLS certificate.
Save the settings again: kyvernon users set-oidc --issuer <url> --client-id <id> --client-secret-file <file> --redirect-uri <url>.

`error.identity.policy_invalid`

Text in the console: The policy value {field} is out of range.
Meaning for API clients: A password or lockout policy value is out of range (field names it).
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`field`	the request field with the value, for example `minLength` or `autoUnlockIntervalSeconds`.

Cause. A value of the password policy or the lockout policy is out of range. The shortest password is at least 12 characters and the longest at most 256, and not shorter than the shortest. The lockout policy counts 1 to 1000 failed logins in a window of 1 second to seven days, and lifts the lockout of an account automatically after 1 second to seven days; a lockout that only an administrator can lift is not offered.

Remedy.

Look at the current policy: kyvernon users password-policy or kyvernon users lockout-policy.
Save it again with a value in range: kyvernon users set-password-policy --min-length <n> --max-length <n> or kyvernon users set-lockout-policy --max-failed-attempts <n> --failed-attempt-interval <n> --auto-unlock-interval <n>.

`error.identity.provider_privilege_in_tenant`

Text in the console: Role {role} holds {privilege}, which cannot be granted inside a tenant's folders and pools.
Meaning for API clients: The role holds a provider-only privilege (Kyvernon.Firewall.ManageProvider, Kyvernon.Firewall.Bypass), which cannot be granted inside a tenant's folders and pools.
Code: INVALID_ARGUMENT, HTTP 400

Argument	What it holds
`role`	the name of the role.
`privilege`	the provider-only privilege that the role holds.

Cause. A role that holds a provider-only privilege (Kyvernon.Firewall.ManageProvider or Kyvernon.Firewall.Bypass) would apply inside the folders and resource groups of a tenant. That happens in two cases: the role is granted on an object that belongs to a tenant, or a privilege of that kind is added to a role that already applies inside a tenant. Tenants never hold provider privileges, whoever the user or group is.

Remedy.

Grant the role on an object outside the tenant: kyvernon permissions set <entity> <principal> --role <role>.
To give a tenant user firewall rights, use a role without the provider-only privileges. Roles in kyvernon roles list show their privileges.
To keep the provider privilege on a role, create a separate role for it and grant that role only outside tenants: kyvernon roles create <name> --privilege <privilege>.