Google Drive Authentication fails from within Docker container

jerrac · May 9, 2018, 9:50pm

I’m certain this is specific to my docker container. But I’m not sure how to figure out what I’m doing wrong.

If I use the “Test Connection” button on the “Destination” tab, it fails.

Failed to connect: Failed to authorize using the OAuth service: Error: TrustFailure (The authentication or decryption has failed.). If the problem persists, try generating a new authid token from: Duplicati OAuth Handler

I tried using the same Google account on another job via a Duplicati instance that isn’t running in Docker, and it worked perfectly. This was after I made sure both Duplicati instances were running 2.0.3.3_beta_2018-04-02.

I tried getting a new OAuth token. That did not help.

I believe I have the networking configured correctly. I can ping google.com from within the running container.

I also thought there might be missing ssl certs, so I made sure to install ca-certificates.

Is there a way to generate a more detailed error message?

Here is a gist of my code:

gist.github.com

https://gist.github.com/jerrac/e5cfb05d4eb7b468009d7095d8aa83d8

Dockerfile

FROM debian:stretch
RUN apt-get update \
    && apt-get -y --no-install-recommends install \
         libmono-system-net4.0-cil \
         libmono-system-net-http4.0-cil \
         libmono-system-net-http-webrequest4.0-cil \
         libmono-system-servicemodel4.0a-cil \
         libmono-system-servicemodel-discovery4.0-cil \
         libmono-system-serviceprocess4.0-cil \
         libmono-microsoft-csharp4.0-cil \

This file has been truncated. show original

docker-compose.yml

version: "3.3"

networks:
  dupnet:
    driver: bridge
    driver_opts:
      com.docker.network.bridge.name: dupnet

services:
  duplicati:

This file has been truncated. show original

extra iptable rules

# Applied using Anisble role https://github.com/LaneCommunityCollege/aspects_iptables
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o {{ ansible_default_ipv4.interface }} -j MASQUERADE
COMMIT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o {{ ansible_default_ipv4.interface }} -j ACCEPT

This file has been truncated. show original

jerrac · May 9, 2018, 10:10pm

Figured it out. ca-certificates is not enough. I needed ca-certificates-mono as well.

talesam · March 24, 2021, 3:58pm

Hello, I’m having the same problem, what exactly did you do to solve this problem?

Did you install this certificate package on the host?

My server is ArchLinux, I have no mono.

[tales@t4l35 Duplicati]$ sudo pacman -Ss ca-certificates
[sudo] password for tales: 
core/ca-certificates 20181109-4 [installed]
    Common CA certificates (default providers)
core/ca-certificates-mozilla 3.63-1 [installed: 3.62-1]
    Mozilla's set of trusted CA certificates
core/ca-certificates-utils 20181109-4 [installed]
    Common CA certificates (utilities)

ts678 · March 26, 2021, 5:39pm

Is this the same server as described below? If so, mono goes with Duplicati. It’s what runs the code.

Who provided the Duplicati Docker? I don’t use Docker, but generic mono TLS troubleshooting info is
Secure Socket Layer (SSL) / Transport Layer Security (TLS). Note mono has its own certificate store. Prebuilt images “should” take care of that. If you’re building your own, that’s something you must do…