Error "All configured authentication methods failed"

m.sch · May 3, 2019, 10:56am

Hello everybody.
I’m very new to icinga so please be a little be patient with me. I took over a network where icinga is running. That works fine. I’m getting mails if there is a status change.
But icinga web 2 isn’t working. When I’m trying to log in I get the following error message.
“All configured authentication methods failed. Please check the system log or Icinga Web 2 log for more information.”

The log informations looks like this:

May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:39 +0200] critical/IdoMysqlConnection: Exception during database operation: Verify that your database is operational!
May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:45 +0200] information/ConfigObject: Dumping program state to file '/var/lib/icinga2/icinga2.state'
May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:49 +0200] critical/IdoMysqlConnection: Connection to database 'icinga2idomysql' with user 'icingaweb' on 'localhost:3306' failed: "Access denied for user 'icingaweb'@'localhost'
May 03 12:51:09 icinga icinga2[13816]: Context:
May 03 12:51:09 icinga icinga2[13816]:         (0) Reconnecting to MySQL IDO database 'ido-mysql'
May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:49 +0200] critical/IdoMysqlConnection: Exception during database operation: Verify that your database is operational!
May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:59 +0200] critical/IdoMysqlConnection: Connection to database 'icinga2idomysql' with user 'icingaweb' on 'localhost:3306' failed: "Access denied for user 'icingaweb'@'localhost'
May 03 12:51:09 icinga icinga2[13816]: Context:
May 03 12:51:09 icinga icinga2[13816]:         (0) Reconnecting to MySQL IDO database 'ido-mysql'
May 03 12:51:09 icinga icinga2[13816]: [2019-05-03 12:50:59 +0200] critical/IdoMysqlConnection: Exception during database operation: Verify that your database is operational!

How can I verify that the db is operational?

nilmerg · May 3, 2019, 11:12am

The shown log is that of Icinga 2. (Note the missing Web here ) The error says “Access denied”, being more precise than that is difficult.

If you want to troubleshoot why you can’t login into Icinga Web 2 take a look at its log. Probably to be found here: /var/log/icingaweb2/icingaweb2.log (Or syslog)

dnsmichi · May 3, 2019, 11:29am

Hi,

seems you’re mixing the databases here.

icinga (or icinga2) is used for the the IDO database backend. This is where the monitoring core daemon Icinga 2 is writing its status and config data to.
icingaweb is used by Icinga Web being the frontend, it stores its config and users in there. Icinga Web as presentation layer also reads from the IDO resource db.

Make sure to first fix the ido-mysql.conf file for Icinga 2 and ensure it is writing to the database.
Then focus on the authentication issue with Icinga Web 2, likely you’re using the wrong resource.

Cheers,
Michael

m.sch · May 8, 2019, 3:12pm

My ido-mysql.conf looks like this:

library "db_ido_mysql"

object IdoMysqlConnection "ido-mysql" {
  user = "icingaweb",
  password = "password",
  host = "localhost",
  database = "icinga2idomysql"
}

So I’ve tried to run mysql searching for the right database name. But I’m not able to start mysql. I’m getting access denied even as root user.

The messages at the syslog after a faulty login looks like this:
May 8 17:05:33 bw-icinga icingaweb2[1089]: Icinga\Exception\IcingaException in /usr/share/php/Icinga/Util/Translator.php:181 with message: Cannot set locale 'de_DE' for category 'LC_ALL'May 8 17:05:33 bw-icinga icingaweb2[1089]: Icinga\Exception\IcingaException in /usr/share/php/Icinga/Util/Translator.php:181 with message: Cannot set locale 'de_DE' for category 'LC_ALL' May 8 17:05:43 bw-icinga icingaweb2[1087]: Icinga\Exception\IcingaException in /usr/share/php/Icinga/Util/Translator.php:181 with message: Cannot set locale 'de_DE' for category 'LC_ALL' May 8 17:05:43 bw-icinga icingaweb2[1087]: Icinga\Exception\AuthenticationException in /usr/share/php/Icinga/Authentication/User/DbUserBackend.php:232 with message: Failed to authenticate user "icingaweb" against backend "icingaweb2". An exception was thrown: <- Zend_Db_Adapter_Exception in /usr/share/php/Zend/Db/Adapter/Pdo/Abstract.php:144 with message: SQLSTATE[HY000] [1045] Access denied for user 'icingaweb'@'localhost' (using password: YES) <- PDOException in /usr/share/php/Zend/Db/Adapter/Pdo/Abstract.php:128 with message: SQLSTATE[HY000] [1045] Access denied for user 'icingaweb'@'localhost' (using password: YES)

dnsmichi · May 9, 2019, 6:54am

Hi,

the ido-mysql feature named “DB IDO” in the docs needs its own database for storing Icinga 2’s config, status, history. The username should be different to icingaweb in your example.

I’m not sure if you have yet created the database, user and imported the schema for the DB IDO feature yet - please do so by following the docs.

Note

mysql -u root -p should work at this stage. If not, please post the exact steps you’ve taken to install MySQL/MariaDB and the error messages.

Once completed, modify the ido-mysql.conf file again and correct the details. By default, everything is called icinga and you don’t need any modifications in there.

Restart Icinga 2 and run tail -f /var/log/icinga2/icinga2.log to check that the IDO feature connected to the database.

When you are there and it is working, please tell us here. Then we’ll guide you with Icinga Web 2.

Cheers,
Michael

m.sch · May 9, 2019, 7:36am

Hi Michael,

I’ve got connection to the database now.
So I think we can keep going to the Icinga Web 2 problem.

Thanks for your support!

Regards

dnsmichi · May 9, 2019, 7:50am

Ok. First off, check whether the previous setup wizard already had created the icingaweb database and users.

mysql -u root -e 'show databases;'
mysql -u root -e "select user,host from mysql.db where db='icingaweb';"

If that’s not existing, do that manually following this step (leave out the rest!).

Now that Icinga Web 2 has a database and user, verify that the backend is properly configured. This can be done by editing the ini configuration files in /etc/icingaweb2 - specifically we need the database resource.

Should look like this, it should take all the credentials you’ve tested before.

vim /etc/icingaweb2/resources.ini

[mysql-icingaweb]
type = "db"
db = "mysql"
host = "localhost"
port = "3306"
dbname = "icingaweb"
username = "icingaweb"
password = "icingaweb"

Now check in authentication.ini that this points to the database resource.

vim /etc/icingaweb2/authentication.ini

[mysql-auth]
backend = "db"
resource = "mysql-icingaweb"

If the login still fails, verify that the default icingaadmin user has been imported into the database already.

mysql -u icingaweb -picingaweb icingaweb -e 'SELECT * from icingaweb_user;'

If not, here’s the manual steps.

Cheers,
Michael

m.sch · May 9, 2019, 10:05am

I’ve got a database that is called icingaweb2. This database has one user icingaweb. So I’ve checked resources.ini. There are two entries.

[icingaweb_db]
type = "db"
db = "mysql"
host = "localhost"
port = "3306"
dbname = "icingaweb2"
username = "icingaweb"
password = "password"
charset = "latin1"
persistent = "0"

[icinga_ido]
type = "db"
db = "mysql"
host = "localhost"
port = "3306"
dbname = "icinga2idomysql"
username = "icingaweb"
password = "password"
charset = "latin1"
persistent = "0"

The authentication.ini points to the icingaweb_db. That looks fine for me. So I checked the icingaweb_user. There is an icingaadmin and an icingaweb. They are both active.

dnsmichi · May 9, 2019, 10:17am

Ok, and the authentication.ini parts look like?

Cheers,
Michael

m.sch · May 9, 2019, 10:32am

Thats the authentication.ini

[icingaweb2]
backend = “db”
resource = “icingaweb_db”

dnsmichi · May 9, 2019, 11:44am

Ok, strange. Now, what happens in the log when you attempt to login again with icingaadmin/icinga (at this very timestamp)?

Cheers,
Michael

m.sch · May 9, 2019, 12:19pm

Thats the log

May 9 14:15:14 bw-icinga icingaweb2[2542]: Icinga\Exception\AuthenticationException in /usr/share/php/Icinga/Authentication/User/DbUserBackend.php:232 with message: Failed to authenticate user "icingaadmin" against backend "icingaweb2". An exception was thrown: <- Zend_Db_Adapter_Exception in /usr/share/php/Zend/Db/Adapter/Pdo/Abstract.php:144 with message: SQLSTATE[HY000] [1045] Access denied for user 'icingaweb'@'localhost' (using password: YES) <- PDOException in /usr/share/php/Zend/Db/Adapter/Pdo/Abstract.php:128 with message: SQLSTATE[HY000] [1045] Access denied for user 'icingaweb'@'localhost' (using password: YES)

Looks like the user icingaweb has incorrect rights at the database?!?!?!?

Regards

dnsmichi · May 9, 2019, 12:24pm

Ok, then let’s test this.

mysql -h localhost -u icingaweb -ppassword icingaweb2

select * from icingaweb_user;
show grants;

Cheers,
Michael

m.sch · May 9, 2019, 12:27pm

Thats what I get:
±----------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for icingaweb@localhost |
±----------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT USAGE ON . TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE, DROP, INDEX, EXECUTE, CREATE VIEW ON icinga2idomysql.* TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE, DROP, INDEX, CREATE TEMPORARY TABLES, EXECUTE, CREATE VIEW ON icingaweb2.* TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE, DROP, INDEX, EXECUTE, CREATE VIEW ON icinga2.* TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE ON icingaweb2.icingaweb_group_membership TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE ON icingaweb2.icingaweb_user_preference TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE ON icingaweb2.icingaweb_group TO ‘icingaweb’@‘localhost’ |
| GRANT SELECT, INSERT, UPDATE, DELETE ON icingaweb2.icingaweb_user TO ‘icingaweb’@‘localhost’ |
±----------------------------------------------------------------------------------------------------------------------------------------------+

Regards

dnsmichi · May 9, 2019, 12:40pm

Hm. This is getting into black magic. Can you show me the content of /etc/os-release (or the output of icinga2 --version), I am primarily interested in the distribution details.

Cheers,
Michael

m.sch · May 9, 2019, 12:52pm

I don’t like black magic at least at software problems

That’s the version information:

icinga2 - The Icinga 2 network monitoring daemon (version: r2.6.3-1)

Copyright (c) 2012-2017 Icinga Development Team (https://www.icinga.com/)
License GPLv2+: GNU GPL version 2 or later <http://gnu.org/licenses/gpl2.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Application information:
  Installation root: /usr
  Sysconf directory: /etc
  Run directory: /run
  Local state directory: /var
  Package data directory: /usr/share/icinga2
  State path: /var/lib/icinga2/icinga2.state
  Modified attributes path: /var/lib/icinga2/modified-attributes.conf
  Objects path: /var/cache/icinga2/icinga2.debug
  Vars path: /var/cache/icinga2/icinga2.vars
  PID path: /run/icinga2/icinga2.pid

System information:
  Platform: Ubuntu
  Platform version: 16.04.6 LTS (Xenial Xerus)
  Kernel: Linux
  Kernel version: 4.4.0-146-generic
  Architecture: x86_64

Build information:
  Compiler: GNU 4.8.4
  Build host: lgw01-43

dnsmichi · May 9, 2019, 1:36pm

So, Ubuntu and Debian who treat localhost like a Unix-socket connection. You might want to modify the resource to use 127.0.0.1 as host key and try again.

Besides that, you’re using Icinga 2 core in version 2.6.3 which isn’t supported anymore. I suppose you are using the Ubuntu packages, and not packages.icinga.com as suggested by our docs. That upgrade is your homework after resolving the web problem then.

Cheers,
Michael

theFeu · September 17, 2021, 2:02pm

2 posts were split to a new topic: Failed to check health: Zend_Db_Adapter_Exception