Unable to log in to Mobile Agent, with message "server_error: Can't generate hash for empty plain token."

[Mark A_ Miller]

Mobile Agent was functioning normally on a subprod instance with Rome Patch 5. We cloned our prod instance back to restart our sandbox development efforts with a fresh instance with production data, and upgraded to Rome Patch 6 Hotfix 1. Now we are unable to log in to our instance using the Mobile Agent native client, on both Android and iOS. We are able to log in to the instance in a browser normally using our admin accounts. 

Here is the message displayed on the mobile device when attempting to log in using Mobile Agent: 

"server_error: Can't generate hash for empty plain token."

On Android we can view a stack trace: 

Android stack trace text: 

com.servicenow.sdk.auth.SSOLoginActivity.W(:3)
ae.c0.a(Unknown Source:4)
com.servicenow.sdk.auth.b.M(:3)
com.servicenow.sdk.auth.b.e(Unknown Source:0)
ae.k.a(Unknown Source:10)
net.openid.appauth.f$a.c(:11)
net.openid.appauth.f$a.onPostExecute(:1)
android.os.AsyncTask.finish(AsyncTask.java:771)
android.os.AsyncTask.access$900(AsyncTask.java:199)
android.os.AsyncTask$InternalHandler.handleMessage(AsyncTask.java:788)
android.os.Handler.dispatchMessage(Handler.java:106)
android.os.Looper.loop(Looper.java:223)
android.app.ActivityThread.main(ActivityThread.java:7656)
java.lang.reflect.Method.invoke(Native Method)
com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592)
com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947)

Multi-factor authentication is disabled in System Properties.

From the Android stack trace, it appears that there is some attempt to apply SSO logic, but we have never configured SSO login for our environment.

All plugins that we believe to be relevant have been enabled, including com.sg.agent_native_client and com.sn_fsm_mobile.

We are still able to log in to our PDIs using Mobile Agent. The issue is on our subprod instance.

We are trying to determine if there is something in Rome Patch 6 Hotfix 1 that has disrupted our mobile login configuration.

If anyone has any ideas we would appreciate the assistance.

[PaulSylo]

Hi - The same issue got resolved by Servicenow when they restarted the nodes from their end. Sometimes, nodes from the Servicenow end may have some issue. I likely this will resolve you issue, as you are also getting in same pattern ( after upgrading the latest patch). Connect with Servicneow support once.

[Mark A_ Miller · Accepted solution]

Thank you @Paul Sylo, we found a solution internally. 

We were able to resolve our mobile login issue internally by digging through the system logs and finding a log entry stating:

Invalid oauth credential record. id:d3540325db098910ca2a0e04e2961949: no thrown error

We ended up going to the OAuth Credentials [oauth_credential] list under System OAuth > Manage Tokens, and deleting any credential records for the users with the login errors. Login via Now Mobile and Mobile Agent resumed immediately for those users.

[Muralidharan BS]

Thanks for sharing the details,

[Mark A_ Miller]

Further clarification on a potential cause: Now Support informed us that in a certain date range last week – one that included the precise time that we had cloned over our subprod instance – their cloning engine was erroneously cloning records even from excluded tables. 

We believe the invalid oauth credential records could have been erroneously imported from our production instance during the clone, breaking the login process. Now Support has asked us to roll back our instance.