Page 1 of 1

Self-Service: Authentication problem

Published: August 5, 2020 - 5:04 PM
by Malo
Hello,

I'm getting an error message when I try to log in to WAPT Self-Service: "Incorrect username or password." This has never happened on other machines, but it's consistent on this one.

I've added the user to the waptselfservice security group and I'm using my Windows login credentials, as usual. I ran `gpresult /r` and I can see that the machine is applying the GPO. I'm sure of my password.

The worst part is that I deleted the waptselfservice security group to see what would happen, and... the error message didn't change! It should be saying "There are no self-service rules present on the machine."

To top it all off, I tried removing the machine from the WAPT console to start over from scratch. And now I can't recover it, even though the agent is still installed on that client machine.

I should mention that I've rebooted countless times.

Thank you for all your help! I've been stuck for hours. (>0

WAPT server 1.8.2.7267: a W16 server,
client: W10, WAPTagent Community 1.8.2.7267)

Re: Self-Service: authentication problem

Published: August 6, 2020 - 5:13 PM
by jpele
Good morning,

I invite you to log in as a local administrator to uninstall and then manually install the WAPT agent.
Once reinstalled, run the command

Code: Select all

wapt-get register
Once the machine is back up in WAPT, install the following package on the machine to anticipate connection issues with Self Service:
https://store.wapt.fr/store/tis-audit-service-netlogon

Sincerely,
Jimmy

Re: Self-Service: authentication problem

Published: August 10, 2020 - 4:49 PM
by Malo
Hello,

I managed to get my machine back up and running in the console. However, the tis-audit-service-netlogon package wasn't enough to resolve my authentication issue.

I think there are blocked connections between my client machine, my WAPT server, and my Active Directory server. I based https://www.wapt.fr/fr/doc/wapt-securit ... ewall.html my firewall rules

Re: Self-Service: authentication problem

Published: August 10, 2020 - 6:20 PM
by sfonteneau
Hello,

if you are using the enterprise version, I recommend switching to "waptserver-ldap" mode:

https://www.wapt.fr/fr/doc/wapt-usage/w ... elfservice

Wapt uses "win32security.LogonUser" in Python: https://www.programcreek.com/python/exa ... .LogonUser

However, this sometimes doesn't work well; using waptserver-ldap is more reliable.

Simon

Re: Self-Service: authentication problem

Published: August 11, 2020 - 4:34 PM
by Malo
Hello,

I am indeed using the Community version.

It's possible the problem stems from my VPN connection: WAPT might be using my local PC's network interface IP address (instead of the IP address provided by the VPN), and the firewall doesn't like that.

Is it possible to force WAPT to use a different network interface?
Or perhaps at least to only launch the service after I've established my VPN connection?

Thank you in advance.

Re: Self-Service: authentication problem

Published: August 11, 2020 - 6:40 PM
by sfonteneau
Indeed, in my opinion, it's due to the VPN

When the machine starts, the domain controller is unavailable because the VPN is not up, so the machine has no TGT. And I don't believe the machine attempts to renegotiate it later.

And so it seems to me that indeed that

Code: Select all

win32security.LogonUser
doesn't like it.

I don't have a solution for this type of case in the Community version.

If you find a way to force the negotiation of a TGT when the VPN connects, then that could solve the problem.

Re: Self-Service: authentication problem

Published: August 12, 2020 - 3:16 PM
by Malo
Hello,

I tried accessing the Self-Service portal while directly connected to the network, without a VPN. Same problem.

It's as if the error is independent of the network, with authentication linked to the operating system (https://www.wapt.fr/fr/doc/wapt-usage/w ... elfservice).
Could you please explain the authentication mechanism in more detail?

Thank you for your help.