Admin-page says "error: Invalid admin token, please try again."

[oneil1838]

Subject of the issue

after install a fresh instance of vaultwarden via stack (docker compose) in Portainer, I'll tired to login in to the admin-page to set some settings, but the admin token from the compose file didn't work. I only get the error "error: Invalid admin token, please try again."
Problem persits also when I use an encryptet password and also with plain text password.

Deployment environment

OS: Ubuntu 22.04.3 LTS
Docker: 24.0.6, build ed223bc
Docker compose: v2.21.0
Portainer: CE 2.19.0
Nginx Proxy Manager: jc21/nginx-proxy-manager:latest (v2.10.4)
Clients used: firefox 117

###Vaultwarden Docker File
version: '3.3'
services:
server:
container_name: vaultwarden
environment:
- ADMIN_TOKEN='some_secure_stuff'
volumes:
- '/vw-data/:/data/'
ports:
- '82:80'
image: 'vaultwarden/server:latest'
restart: unless-stopped

Steps to reproduce

) open portainer.io website -> login -> choose enviroment -> click on "Stacks" -> click on "add Stack" -> name "Vaultwarden" and insert the attached docker compose file -> click "deploy the stack" -> wait till download is compleate and vaultwarden is healthy
) meanwile create a new host in NPM and assigne cert
) open website from intranet or internet and open the admin-page with "/admin" added to the url -> enter the plain text token, click enter and recive error.

Expected behaviour

I expacted a working admin page

Actual behaviour

Troubleshooting data

log from the vaultwarden container:
/--------------------------------------------------------------------
| Starting Vaultwarden |

Version 1.29.2
This is an unofficial Bitwarden implementation, DO NOT use the
official channels to report bugs/features, regardless of client.
Send usage/configuration questions or feature requests to:
https://github.com/dani-garcia/vaultwarden/discussions or
https://vaultwarden.discourse.group/
Report suspected bugs/issues in the software itself at:
https://github.com/dani-garcia/vaultwarden/issues/new
--------------------------------------------------------------------/
[NOTICE] You are using a plain text ADMIN_TOKEN which is insecure.
Please generate a secure Argon2 PHC string by using vaultwarden hash or argon2.
See: https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
[2023-09-07 20:59:36.608][vaultwarden][INFO] Private key created correctly.
[2023-09-07 20:59:36.609][vaultwarden][INFO] Public key created correctly.
[2023-09-07 20:59:36.663][start][INFO] Rocket has launched from http://0.0.0.0:80
[2023-09-07 20:59:56.555][request][INFO] GET /admin
[2023-09-07 20:59:56.556][response][INFO] (admin_page_login) GET /admin/ [2] => 200 OK
[2023-09-07 21:00:56.274][request][INFO] POST /admin
[2023-09-07 21:00:56.274][vaultwarden::api::admin][ERROR] Invalid admin token. IP: 10.10.10.77
[2023-09-07 21:00:56.274][response][INFO] (post_admin_login) POST /admin/ => 401 Unauthorized

[BlackDex]

Best to remove the quotes around your password, unless you want those to be part of it.

[oneil1838]

hi, thx for the tip, this works, but only with plain text pw, if I use the "docker exec -it vaultwarden /vaultwarden hash" command and use the generated string (with an without the '') it didn't work

[stefan0xC]

See the section "How to prevent variable interpolation in docker-compose.yml"

[oneil1838]

thx a lot for this fast aswers, you gus are awsome :)

[SebastianHanz]

When using .env-file, I had to use single quotes for the argon2-string:

The official solution from the documentation LINK above didn't work for me:

VAULTWARDEN_ADMIN_TOKEN=$argon2id$v=19$m=65540,t=3,p=4$MmeK.....

Output for ADMIN_TOKEN looked like this:

I had to add single quotes around the string like this

VAULTWARDEN_ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$MmeK.....'

Now output seems to be correct and password is working on admin page:

I really wondered about that because the Wiki clearly mentioned not to use quotes in the .env-file.

Someone with similar problems or can agree?

[stefan0xC]

Someone with similar problems or can agree?

@SebastianHanz It seems to depend on the version of docker compose in use. With the old (probably outdated?) docker-compose v1.29.2 it does not seem to matter. With Docker Compose version v2.21.0 I can observe the same behavior as you. Apparently they introduced this change in v2.7+: docker/compose#9704 (comment) (also adding a --no-interpolate option in later versions).

We should probably clarify this so it's less confusing.