PQS Error: requests with an empty user-id

I’m trying to setup PQS for the first time. I’m getting this error when it tries to connect to the participant node:

Exception in thread "zio-fiber-" io.grpc.StatusException:
   INVALID_ARGUMENT: INVALID_ARGUMENT(8,0):
   The submitted command has invalid arguments:
   requests with an empty user-id
   are only supported if there is an authenticated user

What do I do?

This can be caused by PQS receiving an incompatible auth token from the IAM. For example, your IAM may be providing a deprecated custom Daml claims access token.

1. In your PQS configuration, enable debug-level logging:

   logger {
     level = "Debug"
   }
   

2. Restart PQS.

3. Search the logs for a line like the following:

   "access_token" : "eyJra...FsJg"
   

   Note: the access token will be a very long text string.

4. Decode the token using jwt.io or jq:

    echo 'eyJra...FsJg' | jq -R 'split(".") | .[0], .[1] | @base64d | fromjson'
   
   

5. Confirm that the token matches the following:
   a. format requirements in the docs
   b. the sub: claim value matches the Daml user you are using for PQS syncing.