{"record":{"id":"92b1148da71c35b7","repo":"nats-io/nats-server","slug":"authorized-user-on-account-q-outside-of-valid-con","errorCode":null,"errorMessage":"authorized user on account %q outside of valid connect times","messagePattern":"authorized user on account %q outside of valid connect times","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth_callout.go","lineNumber":195,"sourceCode":"\t\t\tjwtIssuer = arc.IssuerAccount\n\t\t}\n\n\t\tif jwtIssuer != issuer {\n\t\t\tif !isOperatorMode {\n\t\t\t\treturn _EMPTY_, fmt.Errorf(\"wrong issuer for auth callout response on account %q, expected %q got %q\", account, issuer, jwtIssuer)\n\t\t\t} else if !acc.isAllowedAcount(jwtIssuer) {\n\t\t\t\treturn _EMPTY_, fmt.Errorf(\"account %q not permitted as valid account option for auth callout for account %q\",\n\t\t\t\t\tarc.Issuer, account)\n\t\t\t}\n\t\t}\n\t\treturn jwtIssuer, nil\n\t}\n\n\tgetExpirationAndAllowedConnections := func(arc *jwt.UserClaims, account string) (time.Duration, map[string]struct{}, error) {\n\t\tallowNow, expiration := validateTimes(arc)\n\t\tif !allowNow {\n\t\t\tc.Errorf(\"Outside connect times\")\n\t\t\treturn 0, nil, fmt.Errorf(\"authorized user on account %q outside of valid connect times\", account)\n\t\t}\n\n\t\tallowedConnTypes, err := convertAllowedConnectionTypes(arc.User.AllowedConnectionTypes)\n\t\tif err != nil {\n\t\t\tc.Debugf(\"%v\", err)\n\t\t\tif len(allowedConnTypes) == 0 {\n\t\t\t\treturn 0, nil, fmt.Errorf(\"authorized user on account %q using invalid connection type\", account)\n\t\t\t}\n\t\t}\n\t\treturn expiration, allowedConnTypes, nil\n\t}\n\n\tassignAccountAndPermissions := func(arc *jwt.UserClaims, account string) (*Account, error) {\n\t\t// Apply to this client.\n\t\tvar err error\n\t\tissuerAccount, err := getIssuerAccount(arc, account)\n\t\tif err != nil {\n\t\t\treturn nil, err","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth_callout.go#L177-L213","documentation":"The auth callout's user JWT carries time restrictions (validateTimes), and the connection attempt falls outside the allowed window, so the server refuses to assign the account and rejects the user. This enforces connect-time windows encoded in the user claims returned by the callout.","triggerScenarios":"The AuthorizationResponseClaims' user JWT has valid from/until style time constraints and validateTimes returns allowNow=false because the current server time is before the start or after the end of the window.","commonSituations":"Temporary/short-lived user JWTs issued by the callout expiring before a reconnect; clock skew between callout issuer and server making an apparently-valid JWT outside its window.","solutions":["Re-request authorization so the callout issues a user JWT with a current, valid time window.","Fix clock synchronization (NTP) between the callout service and the NATS server.","Widen the time window in the callout's claim generation for long-running connections."],"exampleFix":"// before\narc.Expires = time.Now().Add(5 * time.Second) // expires almost immediately\n// after\narc.Expires = time.Now().Add(30 * time.Minute)","handlingStrategy":"validation","validationCode":"vr := jwt.CreateValidationResults()\narc.Validate(vr)\nnow := time.Now()\nif arc.Expires > 0 && now.After(time.Unix(arc.Expires, 0)) {\n    return errors.New(\"user claims expired; request a fresh authorization response\")\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"outside of valid connect times\") {\n    // request new credentials from the callout and reconnect\n}","preventionTips":["Issue user JWTs with generous windows relative to expected connection times.","Synchronize clocks with NTP across callout and server.","Refresh credentials before expiry on long-lived connections."],"tags":["auth-callout","jwt","time-window"],"backgroundTag":"jwt-token-expired","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}