nRF9161 Cloud Auto-Provisioning / Onboarding

[nrao32]

Hello,

I'm trying to set up auto-provisioning and onboarding in my project as described in this sample:
https://github.com/nrfconnect/sdk-nrf/blob/066ac6f61fe19ad91d805fd788d782e245f09a2e/samples/cellular/nrf_cloud_rest_device_message/README.rst#provisioning-and-onboarding-your-device-to-nrf-cloud

From what I can see in the device logs, it looks like it was able to nab credentials from the nRF cloud:

[00:00:00.761,505] <inf> iotr: Reset reason: 0x10001
[00:00:00.927,551] <inf> iotr: Waiting for modem to acquire network time...
[00:00:09.125,366] <inf> iotr: Connected to LTE network
[00:00:09.938,842] <inf> iotr: Network time obtained
[00:00:09.939,056] <wrn> nrf_cloud_log: Unable to filter logs for module 0: nrf_cloud_rest
[00:00:09.939,117] <wrn> nrf_cloud_log: Unable to filter logs for module 1: nrf_cloud_jwt
[00:00:09.939,178] <wrn> nrf_cloud_log: Unable to filter logs for module 2: rest_client
[00:00:09.939,483] <wrn> nrf_cloud_log: Unable to filter logs for module 8: nrf_cloud_log
[00:00:09.939,544] <wrn> nrf_cloud_log: Unable to filter logs for module 9: nrf_cloud_codec
[00:00:09.939,605] <wrn> nrf_cloud_log: Unable to filter logs for module 10: nrf_cloud_codec_internal
[00:00:09.939,605] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:09.940,277] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.103,607] <inf> iotr: nRF Cloud credentials detected
[00:00:10.103,637] <inf> iotr: Sent device alert to the nRF cloud
[00:00:10.129,852] <inf> iotr: Injected time (GPS day 16385, GPS time of day 25955)
[00:00:10.137,878] <inf> iotr: Injected location for MCC <hidden>
[00:00:10.137,908] <inf> iotr: Reset reason: 0x0
[00:00:10.138,397] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.229,919] <inf> iotr: Got device ID: <hidden>
[00:00:10.229,949] <inf> iotr: Waiting for modem to acquire network time...
[00:00:10.990,325] <inf> iotr: Provisioning started
[00:00:11.100,952] <inf> nrf_provisioning_http: Requesting commands
[00:00:11.101,409] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:13.230,987] <inf> iotr: Network time obtained
[00:00:13.231,018] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:13.359,161] <inf> iotr: nRF Cloud credentials detected
[00:00:15.038,940] <inf> nrf_provisioning_http: Connected
[00:00:15.039,001] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:15.039,001] <inf> iotr: Provisioning stopped
[00:00:15.039,611] <inf> nrf_cloud_log: Sent lines:0, bytes:0

However, when I go into nRF Cloud to "Add LTE device", I get an error that it hasn't been provisioned:

When I first got the device, I claimed it already (its device GUID shows up under my claimed devices section in the nRF Cloud portal with status "Ready").

However, none of my alerts are actually showing up in the Alerts section, despite the device logs showing no errors. Any ideas?

[Charlie]

Hi,

Thanks for checking with use about this issue.

nRF9161DK deoes not support just-in-time provisioning (JITP). Please follow Cellular: nRF Cloud REST Device Message document and pay attention to HW and NCS versions.

You nRF9161DK should be avaliable on nRF Cloud now. Please check if other basic function works or not with Cellular: nRF Cloud multi-service. Learn about Using device alerts about how alert is triggered.

Best regards,

Charlie

[nrao32]

I've been following along the device alerts and added in the relevant config to prj.conf. Now I get a new error:

[00:00:13.953,491] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:13.997,375] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:13.997,497] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:13.997,589] <err> nrf_cloud_alert: Error sending alert via REST: -77
[00:00:13.997,619] <err> iotr: Error sending alert to cloud: -77
[00:00:14.177,886] <inf> iotr: nRF Cloud credentials detected
[00:00:14.794,708] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:14.794,799] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:14.794,860] <err> nrf_cloud_log: Error sending message:-77
[00:00:14.794,952] <err> nrf_cloud_log: Data: [{"appId":"LOG","dom":0,"lvl":1,"src":"nrf_cloud_alert","ts":1731741735293,"seq":0,"msg":"Error sending alert via REST: -77"},{"appId":"LOG","dom":0,"lvl":1,"src":"iotr","ts":1731741735293,"seq":1,"msg":"Error sending alert to cloud: -77"}], len: 240
[00:00:14.895,111] <err> nrf_cloud_log: Error -77 ret 0 processing ring buffer
[00:00:14.895,111] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:14.895,446] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:15.457,275] <inf> nrf_provisioning_http: Connected
[00:00:15.457,305] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:15.457,305] <inf> iotr: Provisioning stopped

I'll keep digging in to see if it's something else I'm missing.

[nrao32]

I tried generating a JWT token myself to test:

char jwt_buf[512];
	char buf[64 + 1];

	struct jwt_data jwt = { .audience = NULL,
				.sec_tag = CONFIG_NRF_PROVISIONING_JWT_SEC_TAG,
				.key = JWT_KEY_TYPE_CLIENT_PRIV,
				.alg = JWT_ALG_TYPE_ES256,
				.jwt_buf = jwt_buf,
				.jwt_sz = sizeof(jwt_buf),
				/* The UUID is present in the iss claim */
				.subject = NULL };

	/* Check if modem time is valid */
	err = nrf_provisioning_at_time_get(buf, sizeof(buf));
	if (err != 0) {
		LOG_ERR("Modem does not have valid date/time, JWT not generated");
		return -ETIME;
	}

	jwt.exp_delta_s = CONFIG_NRF_PROVISIONING_JWT_MAX_VALID_TIME_S;

	LOG_INF("Generating JWT");
	err = modem_jwt_generate(&jwt);
	if (err) {
		LOG_ERR("modem_jwt_generate failed to generate, error: %d", err);
	}

I get a token back, but something seems to be wrong with it. When I plug in the token to jwt.io for example, it says that the token has an invalid signature:

The nRF cloud's JWT validator also says it's invalid:

[nrao32]

So, one of the issues was just how I was dumping it into stdout, as it was missing some lines. When I got all the lines in properly, I now get a valid result:


However, the nrf code still errors out:

[00:00:17.306,854] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:17.306,945] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:17.307,037] <err> nrf_cloud_alert: Error sending alert via REST: -77

The code I'm referring to is here:
sdk-nrf/samples/cellular/nrf_cloud_rest_device_message/src/main.c at 066ac6f61fe19ad91d805fd788d782e245f09a2e · nrfconnect/sdk-nrf

[Charlie]

Hi,

I played with NCS 2.8.0 Cellular: nRF Cloud multi-service to verfiy the Auto-Provisioning / Onboarding today. Below is my process:

I build the firmware with extra config overlay-http_nrf_provisioning.conf and also set CONFIG_TEMP_ALERT_LIMIT=5 to triger Alert easily.

Following Managing claimed devices using the nRF Cloud portal after programing above firmware.

I can see my device change from READY->PROVISIONED, also the log from nRF9161DK says "cloud_provisioning: Provisiong completed"

[00:00:19.702,301] <inf> cloud_connection: Network connectivity gained!
[00:00:20.702,789] <inf> nrf_provisioning_http: Sending response to server
[00:00:21.540,985] <inf> cloud_provisioning: Provisioning completed.
[00:00:21.541,015] <inf> sample_reboot: Rebooting in 10s...
[00:00:26.541,046] <inf> cloud_provisioning: Provisioning is idle.
[00:00:26.550,506] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:28.194,549] <inf> cloud_connection: Connected to nRF Cloud
[00:00:28.655,029] <inf> shadow_config: Sending reported configuration
[00:00:29.340,179] <inf> application: Waiting for modem to determine current date and time
[00:00:29.351,654] <inf> application: Current date and time determined
[00:00:29.361,450] <inf> nrf_cloud_log: Changing cloud logging enabled to:1
[00:00:29.372,802] <inf> cloud_connection: Reducing provisioning check interval to 30 minutes
[00:00:29.390,014] <inf> application: Temperature is 24 degrees C

The nRF Cloud->Device Management-> Device-> 50363953-3234-4ab4-8025-0e085exxxx management apge shows one alert for "Temperature over limit!".

Then I start to run Cellular: nRF Cloud REST Device Message sample, since the nRF9161DK has already been provisioned to nRF Cloud. I do not need to claim it again, but I sitll need to add extra config overlay-http_nrf_provisioning.conf since it has other configuration the device going to use for connection, like JWT support.

After program the firmware and run, I can find the REST Messages appear on the device terminal on nRF Cloud.

Best regards,

Charlie