"You can't access this resource" error using default login screen

[ghost]

I can't login to my piwik instance using Piwik Mobile app default login page. The error message says: "You can't access this resource as it requires an View access for at least one website." The error is thrown immediately after login. On the server, there is one user (me, superadmin) and one page.

However!
When I go to "Try it > Accounts > Add new account," using the very same url, login and password, it works and I can browse my page statistics.

Environment:

• app version: "2.0.1 - 3.2.0 543fc64"
• app platform: "iPhone OS 7.1.2 iPhone6,2 (en)"
• piwik version: 2.4.1
• installed on intranet, accessed on HTTP via VPN

[tsteur]

This should be actually fixed in Piwik 2.4.1. Can you try whether it works meanwhile? Maybe something was cached.

[tsteur]

Please reopen at any time in case it does not work now as mentioned. There was an issue in Piwik 2.4.0 for sure but fixed in Piwik 2.4.1

[whispy]

I have this same issue, except I cannot login via either method described in the first post (i.e. neither logging in from the main screen nor from adding a new account work).

Phone: Android 4.1.2, Galaxy S3
App Version: 2.0.1
Piwik Version: 2.4.1

EDIT: I created a new account and gave it view permissions, and I was able to login with it. I guess you can't login on mobile with the superuser account.

[tsteur]

I assume the account you are using has actually access to at least one account? Maybe you can try to uninstall the app and install it again? Or maybe even better directly try the latest that beta we released today: http://piwik.org/blog/2014/08/piwik-mobile-2-1-beta-android/

I recommend to uninstall the current version first before installing Piwik Mobile 2.1.

Do you know which permission your user has? Is it a super user? View access? Admin access?

BTW: We will probably release a new version of Piwik tomorrow which could also fix the issue.

[tsteur]

Are you maybe using any other 3rd party plugin in your Piwik like LDAP?

[whispy]

Just tried logging in with my superuser account via the beta app, and I got the same view access error. And the only plugin I am using is BotTracker.

[tsteur]

I tried to figure out what could cause this but I did not really find anything. It sounds like a problem in Piwik and not Piwik Mobile but cannot tell for sure.

Basically, the only way this can happen is if SitesManager.getSitesIdWithAtLeastViewAccess returns an empty array which it shouldn't for a super user. I even checked the code in Piwik a few times. Can you do me a favor and open the API page by clicking on your username on the top right and then "API"?

On this page should be somewhere the action SitesManager.getSitesIdWithAtLeastViewAccess listed formatted in bold followed by some different formats. Would you mind clicking on the json link and paste the output here? It should look like this (maybe more or less numbers):

["1","2","3","4","5","6"]

Can you maybe also try to create another super user just for testing and see whether it works with this one?

[whispy]

My output from the json file: ["1","2"]

I made a second account and gave it superuser permissions. I am able to login with that account. I just tried to login with the original superuser account, but still receive the view access error.

[whispy]

Sidenote: I think that the error message could be made clearer because I had no idea what it was trying to tell me when I first encountered it. Perhaps something like: Your current login credentials do not have view access for at least one website. Please edit access by going to Settings > Users > Manage Access on your Piwik dashboard.

[whispy]

Just upgraded Piwik to 2.5.0, but, unfortunately, I still can't login with the original superuser.

[tsteur]

Thx for checking this. Has Piwik Mobile 2 ever worked for you with the other super user account? If yes, have you recently changed your password? Does maybe your password or your username include any special characters (non alpha-numeric)?

Maybe it is related to this, but shouldn't. Please also make sure the entered password/username is correct and that no autocorrection or other modifications are done. I can otherwise not explain this behavior as it works with your other accounts and the Piwik API seems to behave correct as well.

[tsteur]

I'm gonna reopen this issue so we don't forget to work on his. Would you mind answer the last questions?

[lunarok]

Hi,

I get the same message with latest Piwik Mobile and latest Piwik (2.8)
But only for user from LDAP. The admin superuser coming with the install is able to log on Piwik Mobile.

Is there an issue still exists with LDAP Mobile login ?

[mattab]

@lunarok can you confirm you are also using Ldap v3.0.0 ? http://plugins.piwik.org/LoginLdap

[lunarok]

@mattab yes using v3.0.0, latest from marketplace

[mattab]

@diosmosis do you maybe know why logging in with token_auth for a LDAP user would result in error You can't access this resource as it requires an View access for at least one website. ?

[diosmosis]

@mattab @lunarok Does the user have access to any websites? Login with your superuser to Piwik and check in the Manage > Users admin page if the LDAP user has access to websites.

If you started using LoginLdap recently, and you are not managing user access via LDAP attributes, then you have to either set the 'Initial Sites With View Access For New Users' setting or manually set user access within Piwik after calling the php console loginldap:synchronize-users command.

If the users do have access to websites, then there's a problem either in LoginLdap or Piwik Mobile.

[lunarok]

I have give access to websites to my LDAP user. I try give him view access
to 1 or 3 of the websites. After I try putting him admin of the sites. And
last I try with the super admin status.
None are working.
Is there any log that I can provided about the login attempt ?

2014-10-22 5:06 GMT+02:00 Benaka notifications@github.com:

@mattab https://github.com/mattab @lunarok https://github.com/lunarok
Does the user have access to any websites? Login with your superuser to
Piwik and check in the Manage > Users admin page if the LDAP user has
access to websites.

If you started using LoginLdap recently, and you are not managing user
access via LDAP attributes, then you have to either set the 'Initial Sites
With View Access For New Users' setting or manually set user access within
Piwik after calling the php console loginldap:synchronize-users command.

If the users do have access to websites, then there's a problem either in
LoginLdap or Piwik Mobile.

—
Reply to this email directly or view it on GitHub
#5275 (comment)
.

[diosmosis]

@lunarok You can enable debug logging to a file in Piwik by setting:

[log]
log_level = "DEBUG"
log_writers[] = "file"

then try to login via the mobile device and look at the end of the tmp/logs/piwik.log file for logs from LoginLdap. When you find them, can you email them to benaka@piwik.pro? There shouldn't be any sensitive information in the logs, but it would be better to play it safe and not post the logs on github.

Make sure to disable DEBUG logging after you're done.

Can you also send me a copy of your config.ini.php file? Please remove any sensitive information in it, I just need the LoginLdap settings. You could also take a screenshot of the LDAP settings page if that's better for you.

[lunarok]

Ok, I send to the mail you give the 2 files.
Hope there is something usefull.

2014-10-23 1:49 GMT+02:00 Benaka notifications@github.com:

@lunarok https://github.com/lunarok You can enable debug logging to a
file in Piwik by setting:

[log]
log_level = "DEBUG"
log_writers[] = "file"

then try to login via the mobile device and look at the end of the
tmp/logs/piwik.log file for logs from LoginLdap. When you find them, can
you email them to benaka@piwik.pro? There shouldn't be any sensitive
information in the logs, but it would be better to play it safe and not
post the logs on github.

Make sure to disable DEBUG logging after you're done.

Can you also send me a copy of your config.ini.php file? Please remove any
sensitive information in it, I just need the LoginLdap settings. You could
also take a screenshot of the LDAP settings page if that's better for you.

—
Reply to this email directly or view it on GitHub
#5275 (comment)
.

[tsteur]

Closing this issue for now as it seems to be a bug in Piwik