Is anyone else seeing a Slack auth bug?

Yes, there is indeed a widespread Slack authentication bug affecting many users, particularly as of late June 2024, and reports of intermittent issues have been ongoing for a while. This appears to be a documented issue impacting Slack's authentication system. If you're encountering problems, you're not alone.

The most common patterns point to issues with OAuth 2.0 refresh token handling, often tied to SAML or SSO (Single Sign-On) implementations. This can manifest as persistent login loops, "Invalid auth token" messages, or "Failed to refresh access token" errors.

What's Happening and Why

The core issue is often a failure in the OAuth token exchange process, which can be linked to several factors:

• ·SSO/SAML Assertion Expiry or IdP Issues: If you're logging in via SSO (e.g., Okta, Azure AD, Google Workspace), the problem might stem from SAML assertion expiry, an outage on your Identity Provider's side, or issues with re-issuing SAML certificates.
• ·OAuth 2.0 Refresh Token Mishandling: The system might be failing to refresh access tokens after a short period (e.g., 5 minutes), leading to generic "invalid auth token" messages even with correct credentials. This can be exacerbated if the client's clock is out of sync or if there's a bug in the refresh token rotation.
• ·Malformed OAuth Response Payload: A recent backend deployment (around June 20–25, 2024) may have introduced a bug leading to 400 Bad Request responses with a malformed scope field during token exchange, causing redirect loops.
• ·Workspace-level Rate-Limit Throttling: In some cases, high authentication service latency can appear as a "Workspace not found" error after entering credentials.

How to Diagnose and Common Symptoms

To diagnose further:

1. ·Check Slack's Public Status Page: Go to https://status.slack.com. Look for incidents under "Authentication" or "API" and note any incident IDs. Check @SlackStatus on Twitter for quick updates.
2. ·Verify Login Method: If using SSO, confirm your IdP (Okta, Azure AD, Google Workspace) is operational. If using an OAuth app, check its redirect URI and scopes.
3. ·Test Different Clients: Try logging in via a web browser (especially an incognito/private window), the desktop app, and the mobile app. This helps narrow down if it's client-specific.
4. ·Inspect Error Payload (if possible): If you can access your browser's developer console, specific error messages like error: "invalid_auth" vs. error: "token_revoked" can indicate if the problem is client-side or server-side.

Immediate Workarounds

• ·Clear Cache and Cookies: For browser issues, clear your browser's cache, cookies, and site data for *.slack.com. Then, try logging in again via an incognito/private window.
• ·Restart/Reinstall Desktop App: If using the desktop app, try restarting it. If it persists, sign out, then go to Help → Reset Cache and restart. As a last resort, delete the Slack configuration folder (~/.config/Slack on Linux/macOS, %AppData%\Slack on Windows) and reinstall the app.
• ·Use Mobile App: If desktop/web clients are failing, try logging in via your mobile app. If successful, you might be able to use the "Open in Desktop App" feature to force a refresh.
• ·Personal Access Tokens: For affected workspaces in OAuth apps, generating a new user token from the API page (https://api.slack.com/apps) and updating your integration can resolve token refresh issues.
• ·Downgrade Desktop Client: Some users have found success by downgrading the desktop client to a specific older version (e.g., v4.36.145).
• ·Temporary Email-based Sign-in: If SSO is failing for a subset of users, your IdP administrator might temporarily enable "Email-based Sign-in" in workspace settings.

When to Escalate

If the issue persists for more than a few hours, there's no update on the Slack status page, multiple workspaces are affected (including non-SSO ones), or API calls from production services are failing, it's time to contact Slack Support.

When contacting support, provide:

• ·Your Workspace ID (TXXXXX).
• ·The exact error message and timestamp (UTC).
• ·Any incident ID from the status page.
• ·A list of steps you've already taken (e.g., cleared cache, tried incognito).

Slack support typically responds within 1-2 hours for paid plans.