Unable to login in Control Panel

[JasperWelsing]

Bug description

After updating to Statamic 6 I'm not able to login to the control panel anymore.

On the login screen, below the Passkey button I get a validation message Authentication failed. In the console I see the following message:

AbortError: Authentication ceremony was sent an abort signal:
WebAuthnError https://mywebsite.nl/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:264
...

Tried all the obvious actions like clearing the cache etc. But no luck unfortunately.

How to reproduce

Update from 5.0 to 6.0

Logs

nothing here

Environment

Environment
Application Name: Digital Deer
Laravel Version: 12.49.0
PHP Version: 8.4.17
Composer Version: 2.4.3
Environment: production
Debug Mode: OFF
URL: mywebsite.nl
Maintenance Mode: OFF
Timezone: Europe/Amsterdam
Locale: nl

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: file
Database: sqlite
Logs: daily
Mail: smtp
Queue: sync
Session: file

Storage
public/storage: NOT LINKED

Statamic
Addons: 1
Sites: 1
Stache Watcher: Disabled
Static Caching: full
Version: 6.1.0 PRO

Statamic Addons
aryehraber/statamic-captcha: 1.16.0

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[jasonvarga]

Are you trying to log in with a passkey or just email/password?

[JasperWelsing]

I'm trying to login with just my email/password credentials

[jasonvarga]

Does it work in another browser, or private mode?
Do you have a password manager extension?

[vitalijalbu]

@JasperWelsing did you upgraded from v5? If so then go inside config statamic and set file instead of eloquent inside users config param. That solved on my end

[JasperWelsing]

@jasonvarga I have lastpass installed in Firefox. When I disable the extension, the Authentication failed. message disappears, but I'm still not able to login. When I fill in my credentials and hit continue I get redirect back to the login page. The same happens in other browsers.

With LastPass enabled

Without LastPass

[tao]

I am running into the same issue I think.

I am able to login with my email and password without any issues but when I try the "Passkey" button I also get the "Authentication failed." error.

It says this in the javascript logs:

AbortError: Authentication ceremony was sent an abort signal
    WebAuthnError https://www.llresearch.test/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:264
    identifyAuthenticationError https://www.llresearch.test/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:265
    startAuthentication https://www.llresearch.test/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:265
Caused by: AbortError: Cancelling existing WebAuthn API call for new one
    createNewAbortSignal https://www.llresearch.test/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:264
    startAuthentication https://www.llresearch.test/vendor/statamic/cp/build/assets/index-CyJXg3fB.js:265
index-CyJXg3fB.js:265:3686

When you click the passkey button it does a request to /cp/auth/passkeys/options which gets a 200 Response

{
    "challenge":"lkqit8wa3aYDLbKvJ9V6vyvhKD3FEhFxYSlNQicYLNU",
    "allowCredentials":[],
    "userVerification":"required"
}

But it still says that it failed?

But I was able to create the passkey first on the Control Panel without any issues.

I also ran php please auth:migration and the webauthn tables are in the database... but my users are set to the file driver, not eloquent. I checked the config files for changes in Statamic v6 and I see it is set to eloquent as the default now?

But I can't seem to import the users with the eloquent-driver to test it, I'm not sure if that's related or a separate issue:

php please eloquent:import-users

   TypeError 

  class_parents(): Argument #1 ($object_or_class) must be of type object|string, null given

  at vendor/laravel/framework/src/Illuminate/Support/helpers.php:108
    104▕         }
    105▕ 
    106▕         $results = [];
    107▕ 
  ➜ 108▕         foreach (array_reverse(class_parents($class) ?: []) + [$class => $class] as $class) {
    109▕             $results += trait_uses_recursive($class);
    110▕         }
    111▕ 
    112▕         return array_unique($results);

      +16 vendor frames 

[jasonvarga]

I also ran php please auth:migration and the webauthn tables are in the database... but my users are set to the file driver, not eloquent. I checked the config files for changes in Statamic v6 and I see it is set to eloquent as the default now?

@tao The user driver in the cms repo has already been set to eloquent. We override it to file in statamic/statamic which is what you get when you do statamic new.

The tables may have been created, but they wouldn't be used. If you aren't putting users in the database, you shouldn't have needed to run auth:migration anyway. But I think this is getting off-topic. Please open a separate issue if you need to continue on this.

[tao]

No worries @jasonvarga, I was just trying to provide as much information as I could to help diagnose the issue.

[jasonvarga]

Same!

I was able to replicate the errors and are fixed in #13807. But I didn't run into them in exactly the same way as you've described. Hopefully it fixes it them for you too. I'd love to hear once you've had a chance to upgrade. This fix is in 6.2.0.