Access and Permissions
The Config API authenticates every request and decides what the caller can see. Authentication failures all return the same 401 Unauthorized with Invalid authentication credentials provided, so the message alone won't tell you which of these it is. The turbine-api pod logs carry the underlying error.
A valid federated token has no matching Hydrolix user⚓︎
Confirm: The turbine-api logs show User not found. No external user has both an issuer matching the token's iss claim and an external_id matching its sub.
The token is genuine and trusted, so the identity provider side is working. What's missing is the Hydrolix account it maps to. Both claims have to match exactly.
Fix: Federated Authentication: User not found.
Every request from one token issuer returns 401⚓︎
Confirm: The turbine-api pod can't reach the issuer's jwks_uri. Requests from other issuers still succeed, which separates this from a cluster-wide auth failure.
The Config API fetches signing keys from the issuer to verify tokens, so it can't
verify anything while the endpoint is unreachable. Check for a network policy or
firewall rule blocking outbound HTTP from the turbine-api pod.
Fix: Federated Authentication: JWKS endpoint unreachable.
A row policy doesn't restrict the rows a user sees⚓︎
Confirm: The roles attached to the row policy don't overlap the roles attached to the user. A policy reaches a user only through a shared role.
Row policies aren't attached to users. They're attached to roles, and reach a user only if that user holds a matching role, so a policy with no shared role silently does nothing.
Fix: Row-Level Access: Expected row policy not in effect.
A service account token stops working⚓︎
Confirm: The turbine-api logs show Token claimset invalid, or service account token has been revoked. Listing the account's token metadata shows whether it was revoked.
One message covers two different causes, a revoked token and a claimset that no longer validates. Check the revocation state first, since that's the one you can confirm directly from the token metadata.
Fix: Service Accounts: Revoke tokens.
A valid token is rejected even though the issuer is configured⚓︎
Confirm: audience is absent from the issuer entry in turbine_api_trusted_token_issuers, and the identity provider includes an aud claim in its tokens.
Omitting audience doesn't widen what's accepted. It makes the Config API reject
any token that carries an aud claim at all, and most identity providers
include one by default. Set audience to the aud value your provider sends.
Fix: Federated Authentication: Token rejected despite valid issuer configuration.