Decode Auth tokens

[Donovoi (Michael Moran)]

What is the problem you are having with rclone?

Hi Guys, I absolutely love the work you've done with rclone!

I'm unable to decode oauth tokens to retrieve the username. I am able to decode OneDrive Business Tokens,
But so far unsuccessful with OneDrive consumer, and google drive consumer.
Trying to decode with the following has not worked for me:

JWT.IO

Google.auth python library
JWTDetail PowerShell module - works with OneDrive for business
Microsoft's System.IdentityModel.Tokens.Jwt library
Here's an error I'm getting when trying to decode a OneDrive token:

System.IdentityModel.Tokens.Jwt, Version=6.32.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
MethodInvocationException: RClone\libraryload.ps1:155:1
Line |
 155 |  $token = $handler.ReadJwtToken($token)
     |  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Exception calling "ReadJwtToken" with "1" argument(s): "IDX12709: CanReadToken() returned false. JWT is not well formed:
     | 'EwB4A8l6*****RESTOFJWTREDACTED'. The token needs to be in JWS or JWE Compact Serialization Format. (JWS): 'EncodedHeader.EndcodedPayload.EncodedSignature'. (JWE): 'EncodedProtectedHeader.EncodedEncryptedKey.EncodedInitializationVector.EncodedCiphertext.EncodedAuthenticationTag'."

All roads I've gone down are telling me the token I'm getting from

          $Arguments = @(
            '-vv',
            'config',
            'create',
            "$SectionName",
            "$($_)",
            "--config `"$Tempconf`""
          )
          $RCloneProcessParams = @{

            FilePath     = "$RCLONEEXE"
            ArgumentList = $Arguments
            NoNewWindow  = $true
            Wait         = $true
          }
          $RCloneProcess = Start-Process @RCloneProcessParams

is not well formed.

I've tried to work out how the tokens are created but I'm not getting very far.

here is what is in my config after authentication

[chrome-onedrive]
type = onedrive
token = {"access_token":"EwB4A8l6BAAU****REDACTED","token_type":"Bearer","refresh_token":"M.C103_BAY.-CVZ****REDACTED","expiry":"2023-08-07T00:17:29.2557444+10:00"}
drive_id = cab3b23ec3a6a905
drive_type = personal

I have noticed that the tokens that are (what I believe to be) malformed, do not begin with the usual 'ey' and do not have many '.' if any.

My goal is to decode the jwt so I can append the username to sectionname 'chrome-onedrive-username', I'm creating a powershell module for Rclone and we need to know what usernames we have already tried to authenticate

Funny thing is if I try to list files in the share via:

rclone ls chrome-onedrive: --config '.\RClone Config\chrome-onedrive.conf'

it works perfectly. So I'm really stuck.

Here is a google drive token that I can't decode also:

[chrome-drive]
type = drive
token = {"access_token":"ya29.a0AfB_****REDACTED","token_type":"Bearer","refresh_token":"1//09TvPSw***REDACTED","expiry":"2023-08-07T00:56:16.5445458+10:00"}
team_drive = 

And the command I used successfully:

rclone ls chrome-drive: --config '.\RClone Config\chrome-drive.conf' -vv
2023/08/06 23:56:35 DEBUG : rclone: Version "v1.63.1" starting with parameters ["***SHORTENED\\rclone.exe" "ls" "chrome-drive:" "--config" ".\\RClone Config\\chrome-drive.conf" "-vv"]
2023/08/06 23:56:35 DEBUG : Creating backend with remote "chrome-drive:"
2023/08/06 23:56:35 DEBUG : Using config file from "***SHORTENED\\RClone Config\\chrome-drive.conf"
2023/08/06 23:56:37 DEBUG : Google drive root '': 'root_folder_id = ****REDACTED' - save this in the config to speed up startup

Any help on how I can find info on how these tokens are structured or decoded, or if I'm not doing something correctly, please let me know

Run the command 'rclone version' and share the full output of the command.

rclone v1.63.1
- os/version: Microsoft Windows 11 Enterprise N 22H2 (64 bit)
- os/kernel: 10.0.25357.1 (x86_64)
- os/type: windows
- os/arch: amd64
- go/version: go1.20.6
- go/linking: static
- go/tags: cmount

Which cloud storage system are you using? (eg Google Drive)

All of them
but at the moment testing with:
Google Drive
Google Photos
Onedrive - for business and Consumer
Google Cloud Platform

The command you were trying to run (eg rclone copy /tmp remote:tmp)

          $Arguments = @(
            '-vv',
            'config',
            'create',
            "$SectionName",
            "$($_)",
            "--config `"$Tempconf`""
          )
          $RCloneProcessParams = @{

            FilePath     = "$RCLONEEXE"
            ArgumentList = $Arguments
            NoNewWindow  = $true
            Wait         = $true
          }
          $RCloneProcess = Start-Process @RCloneProcessParams

The rclone config contents with secrets removed.

[chrome-drive]
type = drive
token = {"access_token":"ya29.a0AfB_****REDACTED","token_type":"Bearer","refresh_token":"1//09TvPSw***REDACTED","expiry":"2023-08-07T00:56:16.5445458+10:00"}
team_drive = 

A log from the command with the -vv flag

rclone ls chrome-drive: --config '.\RClone Config\chrome-drive.conf' -vv
2023/08/06 23:56:35 DEBUG : rclone: Version "v1.63.1" starting with parameters ["***SHORTENED\\rclone.exe" "ls" "chrome-drive:" "--config" ".\\RClone Config\\chrome-drive.conf" "-vv"]
2023/08/06 23:56:35 DEBUG : Creating backend with remote "chrome-drive:"
2023/08/06 23:56:35 DEBUG : Using config file from "***SHORTENED\\RClone Config\\chrome-drive.conf"
2023/08/06 23:56:37 DEBUG : Google drive root '': 'root_folder_id = ****REDACTED' - save this in the config to speed up startup

[Donovoi (Michael Moran)]

I did some light reading as realised the access tokens are opaque and can only be verified by the server that created them, which means I need to make a request to each server to retrieve the username.

Sorry about the trouble!