Can't Add Device to nrfCloud via REST API

[egood]

Recently I had been having trouble with one of our test devices (shadow was corrupted) on nrfCloud so I decided to delete it and then re-provision and re-add it to nrfCloud to start fresh (something we have done several times before). 

We have a a python script that automates this process by doing the following steps:

1. Loads modem firmware via J-link
2. loads at_client via J-link
3. gets the IMEI via UART
4. generates the certificates by calling -> curl -X POST api.nrfcloud.com/.../{' + IMEI + '}/certificates -d "123456" -H "Authorization: Bearer XXXXXXXXXXX" -H "Content-Type: text/plain" -o' + IMEI + '.json'
6. Loads the certs using the UART and at_client
7. Generates a certs.csv with all the provisioned devices (the scrip can do multiple at once before uploading)
9. Uploades to nrfcloud using -> curl --location --request POST api.nrfcloud.com/.../devices --header "Authorization: Bearer XXXXXXXXX" --header "Content-Type: text/csv" --data-binary "@certs.csv

After running this script the bulk operation failed. with the following error: 

{"errors":"A total of 1 error(s) occurred while processing the CSV [failed row indices (1-based)]: {\"Thing m8-351358811339107 already exists in account with different attributes\":[1]}."}

This seems to indicate that the device already exists, but there is no record of it in GUI interface and when call FetchDevice via the API I get:

{
    "message": "Cannot verify device ownership (missing tenantId attribute)",
    "code": 40410
}

We had previously see this same scrip work as recently as 2024-01-24T21:31:58.073Z(UTC)

Any help would be great, we currently have not way to use this development device in question until this is resolved.

Thanks

[Lincoln Thomas]

Hello Eric,

That device is shown as provisioned but not associated with any team yet. This normally occurs if you flash JITP certs you obtained from /devices/{' + IMEI + '}/certificates  onto the device, and then turn on the device, before calling your POST api.nrfcloud.com/.../devices. The device connects to nRF Cloud via MQTT and waits to be associated to a team. Could you have done this?

I have deleted the device from our database. Please try your process again.

[egood]

Thanks for deleting the device on your end, that worked! I have a few additional questions:

1. What would cause nrfCloud to think that we want to use JITP as apposed to just creating the device on nrfCloud? I would like to understand this so we can track down why it happened to prevent it from happening again. Because we do not currently have JITP enabled in our firmware. 

2. Does Nordic typically recommend JITP over the process of just adding the device to the cloud at the time of loading the certs during manufacturing?

Thanks again,

Eric

[egood]

I just re-read your replay. Excuse my quick draw response, you answered my first question. It's possible that the device connected to the cloud before the POST via the REST API was done, We do upload prod firmware after loading the certs, but before uploading the CSV, because as I mentioned we do the units in batches. 

If this does happen is the only way to resolve to allow the device to connect to the cloud with JITP enabled firmware? 

[justin]

egood said:

What would cause nrfCloud to think that we want to use JITP

You are downloading JITP certificates when using https://api.nrfcloud.com/v1#tag/IP-Devices/operation/CreateDeviceCertificate
The AWS JITP process occurs automatically when a device first attempts to make a connection to nRF Cloud.

egood said:

Does Nordic typically recommend JITP

No, JITP is not recommended for production products.
See https://docs.nrfcloud.com/Devices/Associations/Provisioning.html for an overview.

We have example python scripts for creating your own credentials: https://github.com/nRFCloud/utils/tree/master/python/modem-firmware-1.3%2B

See create_device_credentials.py and/or device_credentials_installer.py

[justin]

egood said:

If this does happen is the only way to resolve to allow the device to connect to the cloud with JITP enabled firmware? 

if the device attempts to connect (initiating the JITP process) you will need to add the device to your account using either the nrfcloud.com UI (click the Add devices) button or using the REST API: https://api.nrfcloud.com/v1#tag/IP-Devices/operation/AssociateDevice

[egood]

We have recently been using our provisioning script mentioned above. We now can't add a device for a different reason. The bulk upload to nrfCloud succeeds: with the expected:

{"bulkOpsRequestId":"01HTE5RFRJTY1CP78K1XXX2DSA"}

 

However, nrfCloud UI simply shows. Failed with no feedback. 

Any idea what could be wrong here? Before we at least had some indication of what the issue was. It's the same device previously discussed in this thread. 

[egood]

If I call FetchDevice via the REST API we get:

{
    "message": "This device is not associated with any team.",
    "code": 40410
}

We had previously deleted the device from nrfCloud using the UI and then attempted to re-provision using the same process as in the original post. 

[egood]

Nordic team any update on this? We don't want to attempt to move any devices until this is resolved, because it effetely bricks the unit if we can't use it with nrfCloud.  

[justin]

are you still using JITP certs?

if so, it is likely that this device has performed the JITP process like last time, so the device exists in our system but is not yet associated with your team. 

you can perform the associate step here: https://nrfcloud.com/#/add-device/lte-device

[egood]

Justin,

This was with the JITP process. Adding the device manually did not work unfortunately. I finally bit the bullet and updated the scripts to use the Nordic one provided here: utils/python/modem-firmware-1.3+ at master · nRFCloud/utils (github.com)

Specifically:

create_ca_cert.py

device_credentials_installer.py

nrf_cloud_onboard.py


This did work and got the device onboarded correctly. Still not sure why our older script stopped working as it once did. But we will create a new manufacturing script based on the above mentioned, scripts.  

[justin]

glad to hear.
creating your own credentials will prevent this problem and is the recommended method.