Created host with icinga director not allowed to alter, or refresh check error icinga2: Can't send external Icinga command: 401 Unauthorized. Please check your user credentials.

  • Hi,


    I've installed icinga2, icinga2web and director.

    I can create a host with director and the checking is ok.

    But when i want to refresh the check (check now).

    I got this message: icinga2: Can't send external Icinga command: 401 Unauthorized. Please check your user credentials.


    Latest icinga and icingaweb

    Director module 1.3.1

    Ubuntu 16.04


    I've checked if commands its enabled and it is.


    So if some has an idea most welcome


    Kind regards,


    Bert



    a part of the incinga2 log


    [2017-10-11 13:57:44 +0200] information/ConfigObject: Dumping program state to f ile '/var/lib/icinga2/icinga2.state'

    [2017-10-11 14:00:13 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.16667/s (190/min 950/5min 2854/15min);

    [2017-10-11 14:01:02 +0200] information/WorkQueue: #6 (ApiListener, SyncQueue) i tems: 0, rate: 0/s (0/min 0/5min 0/15min);

    [2017-10-11 14:01:02 +0200] information/WorkQueue: #5 (ApiListener, RelayQueue) items: 0, rate: 0.783333/s (47/min 222/5min 672/15min);

    [2017-10-11 14:01:03 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 0, rate: 3.2/s (192/min 952/5min 2854/15min);

    [2017-10-11 14:01:23 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.16667/s (190/min 952/5min 2852/15min);

    [2017-10-11 14:01:33 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.1/s (186/min 952/5min 2854/15min);

    [2017-10-11 14:02:44 +0200] information/ConfigObject: Dumping program state to f ile '/var/lib/icinga2/icinga2.state'

    [2017-10-11 14:03:09 +0200] information/ApiListener: New client connection from [213.163.92.253]:46018 (no client certificate)

    [2017-10-11 14:03:09 +0200] information/HttpServerConnection: Request: POST /v1/ actions/reschedule-check (from [213.163.92.253]:46018, user: <unauthenticated>)

    [2017-10-11 14:03:09 +0200] warning/HttpServerConnection: Unauthorized request: POST /v1/actions/reschedule-check

    [2017-10-11 14:03:37 +0200] information/ApiListener: New client connection from [213.163.92.253]:46020 (no client certificate)

    [2017-10-11 14:03:37 +0200] information/HttpServerConnection: Request: POST /v1/ actions/reschedule-check (from [213.163.92.253]:46020, user: <unauthenticated>)

    [2017-10-11 14:03:37 +0200] warning/HttpServerConnection: Unauthorized request: POST /v1/actions/reschedule-check

    [2017-10-11 14:03:43 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.16667/s (190/min 952/5min 2856/15min);

    [2017-10-11 14:04:33 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.16667/s (190/min 950/5min 2854/15min);

    [2017-10-11 14:06:12 +0200] information/WorkQueue: #6 (ApiListener, SyncQueue) i tems: 0, rate: 0/s (0/min 0/5min 0/15min);

    [2017-10-11 14:06:12 +0200] information/WorkQueue: #5 (ApiListener, RelayQueue) items: 0, rate: 0.783333/s (47/min 221/5min 664/15min);

    [2017-10-11 14:06:13 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 0, rate: 3.16667/s (190/min 950/5min 2852/15min);

    [2017-10-11 14:07:03 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 4, rate: 3.16667/s (190/min 952/5min 2852/15min);

    [2017-10-11 14:07:44 +0200] information/ConfigObject: Dumping program state to f ile '/var/lib/icinga2/icinga2.state'

    [2017-10-11 14:09:23 +0200] information/WorkQueue: #7 (IdoMysqlConnection, ido-m ysql) items: 6, rate: 3.13333/s (188/min 950/5min 2852/15min);

  • Please provide more details on versions (icinga 2, Icinga Web 2) and how you've configured the command transport using the REST API.

  • Hi Michi,


    Did the installation thru the documentation (how to) etc.

    My icinga2 is r.2.7.1-1

    Icinga2web is 2.4.2


    This is listed in my icinga2 apiuser config:


    /**

    * The APIUser objects are used for authentication against the API.

    */

    object ApiUser "root" {

    password = "********"

    // client_cn = ""


    permissions = [ "*" ]

    }


    If created an cn with the icinga2 wizard


    When i log in with ssh and try this below the outcome is not authorized.


    curl -k -s -u root:icinga 'https://localhost:5665/v1'

    <h1>Unauthorized. Please check your user credentials.</h1>root@guard:~#


    The root password in the apuser file is different then the machine root password.


    Best regards,


    Bert

  • Did you restart Icinga 2 after adding the configuration for the ApiUser object? Verify that the ApiUser actually is loaded into memory, e.g. with icinga2 object list --type ApiUser

  • Hi Michi,


    Thx for your reply, you where right the passwords of root user was different then the one configured in the early stages off the installation.