Authentication broke after docker image update

[barbobandsuch]

After updating the docker image to the current version 3.6.2, authentication is no longer working. Login page loads and I am able to enter the user name and password.

Clicking on login screen results in a pop up from the browser. "bad gateway"

I'm not sure if this is a bug or if there is an error in my setup that wasn't problematic until after the update.

[teelur]

What version did you upgrade from?

I've seen this issue when certain environment variables that were added/changed in v3 aren't set. Check out this migration guide if you are upgrading from v2: https://budgetboard.net/docs/deploy/configuration/migration-guides/v2.x-to-v3.x-migration

[barbobandsuch]

I moved from 3.6.0, so a fairly recent version.

[teelur]

I wonder if this is related to #964. A couple questions:

• Does this occur with local credentials or OIDC login? (Or both?)
• Does the issue reproduce in v3.6.1?

[teelur]

Ah, I believe I've found the issue. Looks like it reproduces when OIDC is disabled and and a user tries to login with local auth. Working on a fix now.

[teelur]

I've put in a fix for #964 in v3.6.3. I have a feeling this should be the same issue. Let me know if that patch doesn't resolve the issue.

[barbobandsuch]

That did it! Everything is working smoothly again.

[barbobandsuch]

Weirdly, this issue has popped up again and I'm not sure why. It's the exact same problem as before.

[teelur]

Did this appear after doing a docker image update again?

[barbobandsuch]

It did. I tried a fresh install but the same thing started happening. I haven't had a chance to look at it further but I also noticed that the server docker seemed to be in a loop of restarting. I'm wondering if there is some kind of conflict between this container and my Immich containers.

[teelur]

If I had to guess, it sounds like some of the configuration isn't applying to the server container as it should be.

It may be worth copying the compose.yml and compose.env file down from the repo, reapplying your customizations to the env file, and attempting to redeploy that way.

Also, if there are any useful logs for the server container, that could be helpful.

I'm assuming that error that is showing up in the UI is from the nginx proxy in the client container having trouble reaching the backend container because it is stuck in a loop.

[barbobandsuch]

This is the log from the server.

[19:51:21 INF] Local authentication only
[19:51:21 INF] New user creation enabled
Cannot load library libgssapi_krb5.so.2
Error: libgssapi_krb5.so.2: cannot open shared object file: No such file or directory
[19:51:22 ERR] An error occurred using the connection to database 'budgetboard' on server 'tcp://budget-board-db:5432'.
Unhandled exception. Npgsql.PostgresException (0x80004005): 28P01: password authentication failed for user "postgres"
at Npgsql.Internal.NpgsqlConnector.ReadMessageLong(Boolean async, DataRowLoadingMode dataRowLoadingMode, Boolean readingNotifications, Boolean isReadingPrependedMessage)
at System.Runtime.CompilerServices.PoolingAsyncValueTaskMethodBuilder1.StateMachineBox1.System.Threading.Tasks.Sources.IValueTaskSource.GetResult(Int16 token)
at Npgsql.Internal.NpgsqlConnector.AuthenticateSASL(List`1 mechanisms, String username, Boolean async, CancellationToken cancellationToken)
at Npgsql.Internal.NpgsqlConnector.Authenticate(String username, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.Internal.NpgsqlConnector.g__OpenCore|209_0(NpgsqlConnector conn, String username, SslMode sslMode, GssEncryptionMode gssEncMode, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.Internal.NpgsqlConnector.g__OpenCore|209_0(NpgsqlConnector conn, String username, SslMode sslMode, GssEncryptionMode gssEncMode, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.Internal.NpgsqlConnector.Open(NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.PoolingDataSource.OpenNewConnector(NpgsqlConnection conn, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.PoolingDataSource.g__RentAsync|33_0(NpgsqlConnection conn, NpgsqlTimeout timeout, Boolean async, CancellationToken cancellationToken)
at Npgsql.NpgsqlConnection.g__OpenAsync|42_0(Boolean async, CancellationToken cancellationToken)
at Npgsql.NpgsqlConnection.Open()
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.OpenDbConnection(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.OpenInternal(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.RelationalConnection.Open(Boolean errorsExpected)
at Microsoft.EntityFrameworkCore.Storage.RelationalCommand.ExecuteReader(RelationalCommandParameterObject parameterObject)
at Microsoft.EntityFrameworkCore.Migrations.HistoryRepository.GetAppliedMigrations()
at Npgsql.EntityFrameworkCore.PostgreSQL.Migrations.Internal.NpgsqlHistoryRepository.GetAppliedMigrations()
at Npgsql.EntityFrameworkCore.PostgreSQL.Migrations.Internal.NpgsqlMigrator.Migrate(String targetMigration)
at Microsoft.EntityFrameworkCore.RelationalDatabaseFacadeExtensions.Migrate(DatabaseFacade databaseFacade)
at Program.

$(String[] args) in /app/BudgetBoard.WebAPI/Program.cs:line 364
at Program.(String[] args)
Exception data:
Severity: FATAL
SqlState: 28P01
MessageText: password authentication failed for user "postgres"
File: auth.c
Line: 331
Routine: auth_failed