Unable to start Pulse: Authentication forced off via environment

[jwgn]

Describe the bug
Had authentication previously disabled, now unable to open the UI.

I am greeted with this message:

Authentication forced off via environment

Pulse detected the legacy DISABLE_AUTH flag. Complete the setup below to rotate credentials, then remove the environment variable and restart Pulse.

If you still need a temporary bypass after rotating, create .auth_recoveryin the Pulse data directory and restart. Remove the file and restart again once you regain access.

I had auth disabled via .env and unit override. Removed both. But the message does not disappear. Where does the env variable come from? I cannot see it here:

root@pulse:/opt/pulse# cat /proc/452/environ | tr '\0' '\n'
LANG=C.UTF-8
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
USER=pulse
LOGNAME=pulse
HOME=/opt/pulse
INVOCATION_ID= some string, no idea if it's some kind of secret
JOURNAL_STREAM=9:126411001
SYSTEMD_EXEC_PID=452
MEMORY_PRESSURE_WATCH=/sys/fs/cgroup/system.slice/pulse.service/memory.pressure
MEMORY_PRESSURE_WRITE=c29tZSAyMDAwMDAgMjAwMDAwMAA=
PULSE_DATA_DIR=/etc/pulse

When trying to set the password on the initial setup page beneath the quoted message, nothing happens. Browser console:

Error: Permission denied to access property "ownerDocument"

XHRPOST
http://pulse.home.arpa:7655/api/security/quick-setup
[HTTP/1.1 401 Unauthorized 2ms]

[INFO] [toast:error] Failed to setup security: Error: {"error":"Authentication required"} <empty string>

Environment:

• Pulse Version: v4.27.1
• Installation Type: ProxmoxVE LXC

Additional context

Restoring my backup from working version 4.25 again. Please provide a working upgrade path.

[rcourtman]

The upgrade path had a real bug. When DISABLE_AUTH was detected the server forced the security setup into the rotation path and demanded Basic Auth even if no credentials existed, so the wizard could never create the first user.

The fix is merged and will ship in the next release, letting the bootstrap token flow proceed automatically whenever credentials are absent even if DISABLE_AUTH was historically set.

Until that build is out you can unblock yourself by reading the bootstrap token from /etc/pulse/.bootstrap_token, pasting that token into the setup wizard, and completing the credential form. After the wizard succeeds, delete any remaining DISABLE_AUTH entries and restart the service; the banner disappears and normal logins work again.

Feel free to wait for the upcoming release instead if you prefer to avoid the manual bootstrap step.

[jwgn]

Thanks. I will wait for the upcoming release 👍

[jwgn]

Same issue with v4.28.0

[INFO] [toast:error] Failed to setup security: Error: {"error":"Authentication required"} <empty string>

root@pulse:~# cat /etc/pulse/.bootstrap_token
cat: /etc/pulse/.bootstrap_token: No such file or directory

Restoring working 4.25 backup again.

[jwgn]

Found the issue. I was editing the wrong file. I edited /opt/pulse/.env instead of /etc/pulse/.env.