Unable to automatically login using Remember Me option

[bcoory]

Describe the bug

After upgrading to 1.2.20 from 1.2.19 I cannot get the remember me function to work after closing the browser. Tried on multiple browsers same issue.

Confirmed Support Authentication Cookies is enabled.

Cleared all cookies and cache from browser.

Cookie info in broswer says it Expires When the browsing session ends.

Rolled back to 1.2.19 to test and works as expected.

Issue occurs with both local and LDAP login.

Single Cacti instance - Tried modifying cacti_session_name with no luck.

cacti_cookie_domain is commented out. I also tried enabling this with our Cacti FQDN with no luck.

To Reproduce

Upgrade and login ticking "Keep me signed in". Save password when prompted by browser. Then close browser and go to cacti site.

Expected behavior

Bypass login page once "Keep me signed in" is ticked.

Desktop (please complete the following information)

• OS: Windows 10 Pro 21H2

• Browser: Latest Chrome, Edge and Firefox

• Version [e.g. 22] Chrome- 100.0.4896.75 Edge- 00.0.1185.39 Firefox- 99.01

[TheWitness]

This is duplicate. Try updating to the latest 1.2.x branch and see if the problem goes away.

[TheWitness]

Another note is that we did a change to the Remember Me support. After you grab the latest goto your User Profile and press the logout everywhere button. If you want to do that for everyone, you simply have to TRUNCATE TABLE user_auth_cache;. There was a bug prior to 1.2.20 where the tokens were not realm away, say LDAP or Local. So, that was added to the user_auth_cache table.

[bcoory]

I have just tried updating to the latest 1.2.x branch and using the "Log out everywhere" button. Still having the same issue.

[TheWitness]

What auth method are you using?

[bcoory]

LDAP. But i get the same issue using a local account.

[TheWitness]

Then, you must not be on the latest or there is some other reason. Did you truncate the table? That might fix it.

[TheWitness]

I see the issue, yea, just truncate the table.

[bcoory]

Definitely on the latest. I checked the table before truncating and it was empty. After that I tried logging in using both a local and AD account and ticking remember but nothing is written to the table.

[TheWitness]

Well that's odd. I can not reproduce. Can you check your browsers debug panel to see if the cookie is being rejected? Are you using https?

[bcoory]

Cookie is there - Using http only

[TheWitness]

Okay, that might be it. Let me see if I can reproduce that way.

[bcoory]

I just tried https, same problem. Nothing in the table yet either. Deleted cookie and it gets recreated ok.

[TheWitness]

It's http that's breaking it. On https it's working fine. Let me look into that. I've been using https for so long as it's where just about everyone is these days.

[TheWitness]

Okay, pull a fresh copy and then remove your cookies before you try again (just in case).

[bcoory]

Odd. Still having the same issue with both http and https after the changes.

[TheWitness]

What PHP version?

[TheWitness]

Using Firefox, you should be able to open the debug window, goto Storage, drill into cookie storage and your view should look like the following. Not the columns that I've highlighted. For this to work 'correctly' you need to be at PHP7.3++

[TheWitness]

If they are not as specified, and you are at PHP7.3+, then delete them one at a time and start over.

[bcoory]

Running PHP7.4. I am running FPM with apache. Will try without FPM also

[bcoory]

It seems the cacti_remembers cookie is not being created. Happening for me in all browsers. HTTP and HTTPS.

[TheWitness]

It may seem to be a stupid question, but it is enabled right? I'm totally unable to reproduce.

[batman978]

Hello, I can confirm this is happening for me too - Firefox and Edge. I don't see 'cacti_rememebers' cookie being created.
I upgraded 1.2.19 to 1.2.20 using PHP 7.4.3 on Ubuntu 20.04. My desktop is Windows 10 Enterprise 21H2

[batman978]

Ahh ... "logout everywhere" worked for me. Sorry I missed that higher in the thread.
I only did it for my account, I didn't do it against the user_auth_cache table.

[bcoory]

It may seem to be a stupid question, but it is enabled right? I'm totally unable to reproduce.

Yes, definitely turned on.

I cannot see any errors in the the console showing the cookie being rejected.

[TheWitness]

@batman978, did you update to the 1.2.x branch? Are you using http or https?

[TheWitness]

@bcoory, what you need to do it goto the login page, bring up the debug panel, and then the network tab, and watch the request and response headers. See below.

[bcoory]

There seems to be no response cookie.

Cacti.mov

[TheWitness]

That really helped. Login, goto Console > Configuration > Settings > Authentication and make your Guest Account something other than admin.

[TheWitness]

I guess we should be blocking the admin account from being a guest account.

[TheWitness]

Logged this bug as a result of the finding. Thanks!

#4731

[bcoory]

I currently have no guest account. Only one local "admin" account and 2 LDAP users.

[TheWitness]

Okay, that's odd. Modify auth_login.php as like below, then post what shows up in the log when you login.

[TheWitness]

Starts at line 201.

[bcoory]

Results below. Tried both local and LDAP.

2022/04/21 08:39:42 - AUTH Username error, not setting token
2022/04/21 08:39:42 - AUTH LOGIN: User 'admin' authenticated
2022/04/21 08:39:05 - AUTH Username error, not setting token
2022/04/21 08:39:05 - AUTH LOGIN: User 'bcoory' authenticated
2022/04/21 08:39:05 - AUTH LOGIN: LDAP User 'bcoory' Authenticated
2022/04/21 08:39:05 - AUTH LDAP_SEARCH: Authentication Success,

[TheWitness]

Are you running any plugins? I'm betting we have a name space collision.

[TheWitness]

Or it could be you simply need to go to the Console > Configuration > Settings > Authentication page and set a guest account, hit save, and then try to login again.

[TheWitness]

It's not a namespace issue though after looking at the error.

[bcoory]

I created a guest account and assigned it on Console > Configuration > Settings > Authentication. Now it is working.

I have never had a guest account in the past.

[TheWitness]

It's kind of crazy. Likely what happened before, is that it was set that way, and you never realized it. It's good you have it set now as your Cacti basically had some areas that if a user went to it were basically unsecured. This is why we prevented the 'guest' account, moving forward from being the primary admin account. I guess what we missed in the upgrade was 'fixing' it if we found it. Glad it's working for you now.

[bcoory]

Many thanks! It looks like I can disable the guest account and remember me is still working.

[KnoAll]

I'm running into a similar issue. I've followed through some of the troubleshooting on this page.
Running v1.2.21 on PHP 7.3.x and 7.4.x. on two different systems both with this issue.
I'm running local realm on HTTP only.
I've checked that Support Auth Cookies is enabled.
Ran a login with the debug/network/cookies, and do not see any response cookies entries.
I have a guest account on both systems, but don't use it/ it is not enabled.
Any help would be appreciated, happy to provide additional info as needed.

[TheWitness]

@netniV just recently fixed it. You are safe to just pull 1.2.x, or you can cherry pick from @netniV's commit.