Docker - after update cannot log in

[jelinek.petr@gmail.com 0]

Hi guys,

I made an update yesterday - pulled the latest docker image (4.7.13.0) and start the container. All went OK, server is running but I could not login anymore. When I tried to log in I was getting error "Invalid username or password". I'm sure I entered the right password. But I tried at least twice to reset password - I found the file with the instructions and PIN. But it seems like it had no effect - I still cannot log in even with no password. Log report:

 *** Error Report ***
        Version: 4.7.13.0
        Command line: /system/EmbyServer.dll -programdata /config -ffdetect /bin/ffdetect -ffmpeg /bin/ffmpeg -ffprobe /bin/ffprobe -restartexitcode 3
        Operating system: Linux version 5.4.203-1-pve (build@proxmox) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP PVE 5.4.203-1 (Fri, 26 Aug 2022 14:43:35 +0200)
        Framework: .NET 6.0.14
        OS/Process: x64/x64
        Runtime: system/System.Private.CoreLib.dll
        Processor count: 16
        Data path: /config
        Application path: /system
        System.Exception: System.Exception: Invalid username or password..
           at Emby.Server.Implementations.Library.DefaultAuthenticationProvider.Authenticate(String username, String password, User resolvedUser)
           at Emby.Server.Implementations.Library.UserManager.AuthenticateWithProvider(IAuthenticationProvider provider, String username, String password, User resolvedUser, CancellationToken cancellationToken)
        Source: Emby.Server.Implementations
        TargetSite: System.Threading.Tasks.Task`1[MediaBrowser.Controller.Authentication.ProviderAuthenticationResult] Authenticate(System.String, System.String, MediaBrowser.Controller.Entities.User)

Where could be a problem? Is there a chance to recover even admin user by the manipulating in some db file? I simply don't want to delete all and start from scratch again...

Thanks.

Petr

 

[Luke 42078]

Hi there, please attach the complete emby server log file. What exactly happened with the forgot password process?

[jelinek.petr@gmail.com 0]

Hi Luke,

thanks for answer. I've just tried log in with old password and then with the empty password. Then I grabbed the log file and attached it. For clarification: 192.168.32.2 is IP of my reverse proxy (traefik), 192.168.32.3 is IP of the server, the host name of my server in my internal network is emby.jelinkovi.doma. This setup worked fine for about two years up to now.

As for password forgot process: when I click on "Forgotten password" (or something like this, sorry the language is Czech and I cannot switch it now...), I can fill the username and click the "Confirm" (Potvrdit):

After that I can see this window informing me that I have to continue in my local network (it is a bit confusing message in Czech but I know I have now to look for the text file in local file system):

I can find the text file "passwordreset.txt" in the config folder.  According to the instructions in this file I navigate to the "/web/index.html#!/startup/forgotpasswordpin.html" path and can enter the pin. If the username is a real (exists in the user database) I get the information that the password of this user has been cleared and I have to log in with empty password now. But this apparently does not work. But one thing in the process is unclear for me and I'm not sure if it can be important or not. In the "passwordreset.txt" file is URL where is the IP address of my reverse proxy but I have use the host name to be redirected properly so I change IP to host name of the server. I'm not sure if this can cause that the process is not successful.

Thanks  for any help.

embyserver.txt

Edited August 14, 2023 by jelinek.petr@gmail.com
typos

[Q-Droid 989]

What was the previous version you had? Can you complete the password reset using the Emby server LAN IP address instead of hostname or reverse proxy?

4.7.13 has changes that can affect how Emby interacts with reverse proxies on LANs using private IP address space (RFC 1918).

 

[jelinek.petr@gmail.com 0]

Hi Q-Droid, thanks a lot for your hint! I removed reverse proxy from the path and everything works again! But I still like to use the Traefik to access this service. Where can I find the additional info about the changes related to reverse proxies in Emby?

Thanks a lot again!

 

[Q-Droid 989]

The change was made starting with 4.7.12 stable and 4.8.0.32-beta. Going forward proxied sessions will always be treated as remote connections whether from LAN or WAN clients. The long term plan from the devs is to remove that distinction between local and remote users for access and logins. We still don't know what that looks like or how it will work.

• Don't allow local network addresses to be specified in x-forwarded-for and x-real-ip

Discussion about the reasons here: 

 

 

[Luke 42078]

In the 4.8 beta channel there's a new setting in Emby Server network settings that allows you to control this, so you can have the previous behavior if desired.

[Q-Droid 989]

27 minutes ago, Luke said:

In the 4.8 beta channel there's a new setting in Emby Server network settings that allows you to control this, so you can have the previous behavior if desired.

I see this setting in .41, I don't know if it was there in .39 or .40.  Is there a description or forum thread where it's discussed? I understand "Yes" and "No" but can't think of the utility for the option "Only when local" as opposed to an option to "Ignore when local".

That said, I do like the addition of a configurable setting for this.

 

[Luke 42078]

11 minutes ago, Q-Droid said:

I see this setting in .41, I don't know if it was there in .39 or .40.  Is there a description or forum thread where it's discussed? I understand "Yes" and "No" but can't think of the utility for the option "Only when local" as opposed to an option to "Ignore when local".

That said, I do like the addition of a configurable setting for this.

 

Sorry my mistake. I worded it wrong, but that option corresponds to the current 4.7.13 behavior.