JWT signature error

[nitishxp]

Hi,
My lib
google-cloud-bigquery==1.26.1
google-auth==1.24.0

I am using Cloud function in runtime. I am getting below error when i am trying to create multiple tables in threading

.create_table(table, exists_ok=True) File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/cloud/bigquery/client.py", line 561, in create_table api_response = self._call_api( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/cloud/bigquery/client.py", line 574, in _call_api return call() File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/api_core/retry.py", line 281, in retry_wrapped_func return retry_target( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/api_core/retry.py", line 184, in retry_target return target() File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/cloud/_http.py", line 472, in api_request response = self._make_request( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/cloud/_http.py", line 336, in _make_request return self._do_request( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/cloud/_http.py", line 374, in _do_request return self.http.request( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/auth/transport/requests.py", line 477, in request self.credentials.before_request(auth_request, method, url, request_headers) File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/auth/credentials.py", line 133, in before_request self.refresh(request) File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/oauth2/service_account.py", line 376, in refresh access_token, expiry, _ = _client.jwt_grant( File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/oauth2/_client.py", line 153, in jwt_grant response_data = _token_endpoint_request(request, token_uri, body) File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/oauth2/_client.py", line 124, in _token_endpoint_request _handle_error_response(response_body) File "/layers/google.python.pip/pip/lib/python3.8/site-packages/google/oauth2/_client.py", line 60, in _handle_error_response raise exceptions.RefreshError(error_details, response_body) google.auth.exceptions.RefreshError: ('invalid_grant: Invalid JWT Signature.', '{"error":"invalid_grant","error_description":"Invalid JWT Signature."}')

[plamut]

@nitishxp Thanks for the report.

I can't yet say what the root cause might be, but for a start, could you try upgrading the installed packages to the latest versions? At the time of writing, they are the following:

google-auth==1.26.1
google-cloud-bigquery==2.8.0

If that doesn't help, would it also be possible to provide a minimal reproducible code sample? Thanks in advance!

[nitishxp]

Hi @plamut ,
Below is the code which u can use to reproduce the error in Cloud Function (python38)

import json
import os
from datetime import datetime
import google.auth
import requests
from google.auth.transport.requests import Request
from google.cloud import bigquery
from google.oauth2 import service_account
from joblib import Parallel, delayed

secret_obj = None

class Sercret:
def init(self):
auth = {}
credentials = service_account.Credentials.from_service_account_info(
auth,
scopes=['https://www.googleapis.com/auth/cloud-platform', 'https://www.googleapis.com/auth/bigquery'],
)

    print(credentials.__dict__)
    self.client = bigquery.Client(credentials=credentials)

def create_table(self, table_id):
    table = self.client.create_table(table_id, exists_ok=True)
    print("Created table {}.{}.{}".format(table.project, table.dataset_id, table.table_id))

def create_table():
id_ = str(datetime.utcnow()).replace(' ', '').replace('-', '').replace(':', '').replace('.', '')
table_id = f'repd-e-eng-04.dschaub7_stage.bigquery{id_}'
secret_obj.create_table(table_id)

def hello_world(req):
global secret_obj
secret_obj = Sercret()
Parallel(n_jobs=10, prefer="threads")(delayed(create_table)() for tbl in range(0, 100))

[plamut]

@nitishxp Just to confirm, the posted code snippet also reproduces the issue with the latest client versions?

[plamut]

@nitishxp Update - this is an external issue (link). Until this is resolved, the workaround is to pin the rsa dependency to version 4.6, i.e. rsa==4.6, as version 4.7 apparently broke something in google-auth that BigQuery also uses.

Hope this helps!

[tswast]

Closing, as the blocking issue googleapis/google-auth-library-python#667 has been resolved.