nRF9161 Cloud Auto-Provisioning / Onboarding

[nrao32]

Hello,

I'm trying to set up auto-provisioning and onboarding in my project as described in this sample:
https://github.com/nrfconnect/sdk-nrf/blob/066ac6f61fe19ad91d805fd788d782e245f09a2e/samples/cellular/nrf_cloud_rest_device_message/README.rst#provisioning-and-onboarding-your-device-to-nrf-cloud

From what I can see in the device logs, it looks like it was able to nab credentials from the nRF cloud:

[00:00:00.761,505] <inf> iotr: Reset reason: 0x10001
[00:00:00.927,551] <inf> iotr: Waiting for modem to acquire network time...
[00:00:09.125,366] <inf> iotr: Connected to LTE network
[00:00:09.938,842] <inf> iotr: Network time obtained
[00:00:09.939,056] <wrn> nrf_cloud_log: Unable to filter logs for module 0: nrf_cloud_rest
[00:00:09.939,117] <wrn> nrf_cloud_log: Unable to filter logs for module 1: nrf_cloud_jwt
[00:00:09.939,178] <wrn> nrf_cloud_log: Unable to filter logs for module 2: rest_client
[00:00:09.939,483] <wrn> nrf_cloud_log: Unable to filter logs for module 8: nrf_cloud_log
[00:00:09.939,544] <wrn> nrf_cloud_log: Unable to filter logs for module 9: nrf_cloud_codec
[00:00:09.939,605] <wrn> nrf_cloud_log: Unable to filter logs for module 10: nrf_cloud_codec_internal
[00:00:09.939,605] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:09.940,277] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.103,607] <inf> iotr: nRF Cloud credentials detected
[00:00:10.103,637] <inf> iotr: Sent device alert to the nRF cloud
[00:00:10.129,852] <inf> iotr: Injected time (GPS day 16385, GPS time of day 25955)
[00:00:10.137,878] <inf> iotr: Injected location for MCC <hidden>
[00:00:10.137,908] <inf> iotr: Reset reason: 0x0
[00:00:10.138,397] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:10.229,919] <inf> iotr: Got device ID: <hidden>
[00:00:10.229,949] <inf> iotr: Waiting for modem to acquire network time...
[00:00:10.990,325] <inf> iotr: Provisioning started
[00:00:11.100,952] <inf> nrf_provisioning_http: Requesting commands
[00:00:11.101,409] <inf> nrf_cloud_log: Sent lines:0, bytes:0
[00:00:13.230,987] <inf> iotr: Network time obtained
[00:00:13.231,018] <inf> iotr: Initializing the nRF Provisioning library...
[00:00:13.359,161] <inf> iotr: nRF Cloud credentials detected
[00:00:15.038,940] <inf> nrf_provisioning_http: Connected
[00:00:15.039,001] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:15.039,001] <inf> iotr: Provisioning stopped
[00:00:15.039,611] <inf> nrf_cloud_log: Sent lines:0, bytes:0

However, when I go into nRF Cloud to "Add LTE device", I get an error that it hasn't been provisioned:

When I first got the device, I claimed it already (its device GUID shows up under my claimed devices section in the nRF Cloud portal with status "Ready").

However, none of my alerts are actually showing up in the Alerts section, despite the device logs showing no errors. Any ideas?

[Charlie]

Hi,

I played with NCS 2.8.0 Cellular: nRF Cloud multi-service to verfiy the Auto-Provisioning / Onboarding today. Below is my process:

I build the firmware with extra config overlay-http_nrf_provisioning.conf and also set CONFIG_TEMP_ALERT_LIMIT=5 to triger Alert easily.

Following Managing claimed devices using the nRF Cloud portal after programing above firmware.

I can see my device change from READY->PROVISIONED, also the log from nRF9161DK says "cloud_provisioning: Provisiong completed"

[00:00:19.702,301] <inf> cloud_connection: Network connectivity gained!
[00:00:20.702,789] <inf> nrf_provisioning_http: Sending response to server
[00:00:21.540,985] <inf> cloud_provisioning: Provisioning completed.
[00:00:21.541,015] <inf> sample_reboot: Rebooting in 10s...
[00:00:26.541,046] <inf> cloud_provisioning: Provisioning is idle.
[00:00:26.550,506] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:28.194,549] <inf> cloud_connection: Connected to nRF Cloud
[00:00:28.655,029] <inf> shadow_config: Sending reported configuration
[00:00:29.340,179] <inf> application: Waiting for modem to determine current date and time
[00:00:29.351,654] <inf> application: Current date and time determined
[00:00:29.361,450] <inf> nrf_cloud_log: Changing cloud logging enabled to:1
[00:00:29.372,802] <inf> cloud_connection: Reducing provisioning check interval to 30 minutes
[00:00:29.390,014] <inf> application: Temperature is 24 degrees C

The nRF Cloud->Device Management-> Device-> 50363953-3234-4ab4-8025-0e085exxxx management apge shows one alert for "Temperature over limit!".

Then I start to run Cellular: nRF Cloud REST Device Message sample, since the nRF9161DK has already been provisioned to nRF Cloud. I do not need to claim it again, but I sitll need to add extra config overlay-http_nrf_provisioning.conf since it has other configuration the device going to use for connection, like JWT support.

After program the firmware and run, I can find the REST Messages appear on the device terminal on nRF Cloud.

Best regards,

Charlie

[nrao32]

Hi Charlie, I imagine I need to set up external flash in order for this to work, based on the first few logs I see. Can you elaborate on what component you had to buy and how you wired it to the nRF9161 DK?

*** Booting My Application v2.1.0-dev-4594a8693738 ***
*** Using nRF Connect SDK v2.8.0-a2386bfc8401 ***
*** Using Zephyr OS v3.7.99-0bc3393fb112 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x18000
I: Jumping to the first image slot
[00:00:00.255,065] <err> spi_nor: Device id 00 00 00 does not match config c8 65 19
*** Booting nRF Connect SDK v2.8.0-a2386bfc8401 ***
*** Using Zephyr OS v3.7.99-0bc3393fb112 ***
[00:00:00.259,857] <inf> main: nRF Cloud multi-service sample has started, version: 1.0.0, protocol: MQTT
[00:00:00.259,887] <inf> application: Reset reason: 0x10001
[00:00:00.260,162] <inf> cloud_connection: Enabling connectivity...
[00:00:00.547,851] <inf> cloud_connection: Setting up nRF Cloud library...
[00:00:00.636,047] <inf> nrf_cloud_info: Device ID: 5033475<HIDDEN>917c
[00:00:00.636,596] <inf> nrf_cloud_info: IMEI:      35<HIDDEN>48
[00:00:00.722,473] <inf> nrf_cloud_info: UUID:      503<HIDDEN>17c
[00:00:00.722,961] <inf> nrf_cloud_info: Modem FW:  mfw_nrf91x1_2.0.1
[00:00:00.722,991] <inf> nrf_cloud_info: Protocol:          MQTT
[00:00:00.723,052] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.723,052] <inf> nrf_cloud_info: Sec tag:           16842753
[00:00:00.723,083] <inf> nrf_cloud_info: Host name:         mqtt.nrfcloud.com
[00:00:00.823,089] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:00.823,150] <inf> nrf_cloud_credentials: CA Size: 1188, AWS: Likely, CoAP: Unlikely
[00:00:00.823,181] <inf> cloud_connection: Waiting for network ready...
[00:00:11.632,110] <inf> cloud_connection: Network connectivity gained!
[00:00:12.632,385] <inf> cloud_provisioning: Initializing the nRF Provisioning library...
[00:00:12.632,568] <inf> cloud_connection: Network is ready
[00:00:12.671,844] <inf> nrf_provisioning: Checking for provisioning commands in 4s seconds
[00:00:16.671,966] <inf> cloud_provisioning: Provisioning is active.
[00:00:16.773,895] <inf> nrf_provisioning_http: Requesting commands
[00:00:19.105,072] <inf> nrf_provisioning_http: Connected
[00:00:19.105,102] <inf> nrf_provisioning_http: No more commands to process on server side
[00:00:19.105,194] <inf> nrf_provisioning: Checking for provisioning commands in 62s seconds
[00:00:24.105,224] <inf> cloud_provisioning: Provisioning is idle.
[00:00:24.105,285] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:28.411,865] <err> nrf_cloud_transport: MQTT input error: -128
[00:00:28.411,926] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:00:28.411,956] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:00:28.411,987] <err> cloud_connection: Could not connect to nRF Cloud
[00:00:28.412,017] <inf> cloud_connection: Retrying in 30 seconds...
[00:00:58.412,139] <inf> cloud_connection: Waiting for network ready...
[00:00:58.412,170] <inf> cloud_connection: Network is ready
[00:00:58.412,170] <inf> cloud_connection: Connecting to nRF Cloud
[00:01:03.047,119] <err> nrf_cloud_transport: MQTT input error: -128
[00:01:03.047,210] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:01:03.047,241] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:01:03.047,271] <err> cloud_connection: Could not connect to nRF Cloud
[00:01:03.047,302] <inf> cloud_connection: Retrying in 30 seconds...
[00:01:21.105,316] <inf> cloud_provisioning: Provisioning is active.
[00:01:21.207,336] <inf> nrf_provisioning_http: Requesting commands
[00:01:23.649,322] <inf> nrf_provisioning_http: Connected
[00:01:23.649,353] <inf> nrf_provisioning_http: No more commands to process on server side
[00:01:23.649,444] <inf> nrf_provisioning: Checking for provisioning commands in 60s seconds
[00:01:28.649,475] <inf> cloud_provisioning: Provisioning is idle.
[00:01:33.047,393] <inf> cloud_connection: Waiting for network ready...
[00:01:33.047,424] <inf> cloud_connection: Network is ready
[00:01:33.047,424] <inf> cloud_connection: Connecting to nRF Cloud
[00:01:37.150,390] <err> nrf_cloud_transport: MQTT input error: -128
[00:01:37.150,451] <err> nrf_cloud_transport: Error disconnecting from cloud: -128
[00:01:37.150,512] <inf> cloud_connection: Disconnecting from nRF Cloud
[00:01:37.150,543] <err> cloud_connection: Could not connect to nRF Cloud
[00:01:37.150,543] <inf> cloud_connection: Retrying in 30 seconds...

[nrao32]

Hi Charlie, I was able to get my device provisioned:



I was also able to claim it:

However, I still get errors when trying to use nRF Cloud services like the location API:

[00:00:18.741,577] <err> nrf_cloud_codec_internal: REST error msg: Invalid JWT
[00:00:18.751,831] <err> nrf_cloud_rest: nRF Cloud REST error code: 40100
[00:00:18.761,627] <err> dev: Failed to send P-GPS request, error: -77

I looked up error code 40100:

nRF Cloud REST API Documentation

Looks to be an authorization issue, not an authentication issue (I validated that the JWT token is valid now):

I might be missing some kind of auth permission. How do I allow my device to access nRF cloud services?

[nrao32]

Update - I found this nRF Location Services evaluation thing in the Teams page: https://nrfcloud.com/#/teams

Using that token worked! However, this is not ideal, since obviously I don't want to use the same token for every device, and would rather have the device authenticate itself instead. However the device's JWT still returns error 40100 which on the docs says "Access denied error. The user making the request does not have access to the requested resource (device, SIM, invitation, etc.). Confirm your authorization is correct."

So, at least I'm unblocked for development, but not a viable option for production. Is this just because I'm on the developer plan? Do I need to upgrade to the pro plan to be able to authorize the devices themselves?

[Charlie]

Hi Neil,

The Service Evaluation Token is only valid for 30 days. It is not recommended to use it for your product, even for development purposes.

The JWT is automatically set up if you follow the steps provided in this discussion: https://devzone.nordicsemi.com/support-private/support/336139#permalink=1017931, but this feature requires a Pro plan.

I apologize for the lack of proper documentation on this matter. I will inform our nRF Cloud team to improve this section of the documentation.

Best regards,

Charlie

[nrao32]

Hi Charlie. The nRF Cloud validator says that my JWT is valid and it's also able to give me the device ID from the JWT, but the nRF Cloud does not allow my device to execute any location APIs. The service eval token works however but I'm already 1/3 of the way through that trial and as you said is not recommended. I will try upgrading to the Pro plan and see if that resolves the issue with the nRF Cloud, but I was hoping to stay on the free tier during development. Let me see if the Pro plan fixes it. Thanks.

[Charlie]

Hi Neil, 

I checked with our nRF Cloud team to confirm whether there could be any differences between the FREE and Pro Plans, but the answer is no. To verify further, I created a new Free Plan account and repeated the steps in https://devzone.nordicsemi.com/support-private/support/336139#permalink=1017931. I did not encounter any errors in the logs.

I suspect there might be an issue with your account. Could you try creating a new account and testing again to confirm?

Best regards,

Charlie