Generating API access token throws error:0909006C:PEM

[R0Wi]

When trying to create a new API access token, I get the following error message:

It was not possible to parse your key, reason: error:0909006C:PEM routines:get_name:no start line

Preparations for API usage have been done like stated in

• https://docs.suitecrm.com/developer/api/developer-setup-guide/json-api/#_before_you_start_calling_endpoints and
• https://docs.suitecrm.com/developer/api/developer-setup-guide/configure-authentication/

Issue

When calling the API access token endpoint {{server}}/legacy/Api/access_token via POST request, the server gives me an error 500 with the following JSON response:

{
    "error": "unknown_error",
    "message": "It was not possible to parse your key, reason: error:0909006C:PEM routines:get_name:no start line"
}

Expected Behavior

Server response 200 containing a valid access token

Actual Behavior

Response mentioned above. No furhter logs.

Possible Fix

The projects uses "lcobucci/jwt": "3.3.3"

SuiteCRM-Core/composer.json

Line 49 in 91064df

"lcobucci/jwt": "3.3.3",

which officially doesn't support PHP 8.0 (see https://packagist.org/packages/lcobucci/jwt#3.3.3). Updating this dependency might help but I'm not sure if this is the root cause. Like stated in some of the source below, this error seems to be related to the PHP version. Some mention that a downgrade to PHP 7.4 would help. Since this version is already deprecated, that's no option for me.

Steps to Reproduce

1. Setup SuiteCRM for API usage
2. Call {{server}}/legacy/Api/access_token with valid credentials

Your Environment

• SuiteCRM Version used: 8.2.1
• Environment name and version: MySQL, PHP 8.0
• Operating System and version: Docker, docker-compose with Bitnami image

Links to similar issues

• Bitnami Image issue: [bitnami/suitecrm] Generating an API access_token throws an error bitnami/containers#17280
• Forum: https://community.suitecrm.com/t/api-and-docker-error-it-was-not-possible-to-parse-your-key/84638/2
• It was not possible to parse your key, reason: error:0909006C:PEM routines:get_name:no start line lcobucci/jwt#310
• https://stackoverflow.com/questions/67733476/when-i-login-then-error-will-be-ocuurred-it-was-not-possible-to-parse-your-key
• https://stackoverflow.com/questions/73211594/lombucci-jwt-it-was-not-possible-to-parse-your-key-reason-error0909006cpem-r

[R0Wi]

I did some more research and debugging and here are my results:

indeed the error seems to come from lcobucci/jwt library. PHP 8.0 compatibility was introduced by lcobucci/jwt@be0f2f9#diff-6019fde4d9e0d7d2d060b7fd9d8ebd89f85be6d89f61de292660c9a01bea8ca9R84 which fixed a breaking change in PHP 8.0. According to the docs for openssl_pkey_get_private:

8.0.0 | On success, this function returns an OpenSSLAsymmetricKey instance now; previously, a resource of type OpenSSL key was returned

I applied the patch of that one line manually and was able to create access tokens again. So an update of lcobucci/jwt to >= 4.0.0 would be sufficient. But since this is also a dependency of league/oauth2-server, that package would also need to be upgraded. This in turn introduces some breaking code API changes which have to be implemented first.

If upgrading the packages accordingly and adjusting the code to the new API would be a solution for you, I could image creating a PR for this.

[corearchitect]

I applied the patch of that one line manually and was able to create access tokens again.

Which specific line did you patch manually?

[R0Wi]

This line here. Basically just replacing ! is_resource($key) with is_bool($key) in the jwt vendors subfolder which is created by composer.

If you scroll up, you can see that the patch is included in jwt >= 4.0.0

So I guess upgrading this dependency should fix the problem.

[johnM2401]

Hey!

Thanks for getting in touch @R0Wi

I believe issues with PHP8 / V8 API compatability were resolved in the most recent release, 8.3.0, as we merged this PR: salesagility/SuiteCRM#9965
(Which seems to cover the upgrading of the packages you noted above)

When you get a moment, would you be able to give 8.3.0 a try and let us know if you are still having issues with the API?

Thanks!

[florian-besser]

Hey @johnM2401 I think salesagility/SuiteCRM#9965 did indeed fix the issue. We're using the bitnami helm charts to install SuiteCRM and using the newest SuiteCRM version 7.13.4 (from docker image docker.io/bitnami/suitecrm:7.13.4-debian-11-r15) does indeed no longer need these fixes.

As long as /bitnami/suitecrm/Api/V8/OAuth2/private.key and /bitnami/suitecrm/Api/V8/OAuth2/public.key are present it'll read them without issues.

Debug output for PHP version:

I have no name!@suite-crm-suitecrm-848fb858d7-wjgdm:/$ php -v
PHP 8.0.29 (cli) (built: Jul 24 2023 21:31:03) ( NTS )
Copyright (c) The PHP Group
Zend Engine v4.0.29, Copyright (c) Zend Technologies
    with Zend OPcache v8.0.29, Copyright (c), by Zend Technologies