[Question]

[Martin1649]

Request Type

Question

Work Environment

Question	Answer
OS version (server)	CentOS
Virtualized Env.	True
Dedicated RAM	8 GB
vCPU	8
TheHive version / git hash	4.x, hash of the commit
Package Type	RPM
Database	Cassandra
Index type	Lucene
Attachments storage	Local
Browser type & version	If applicable

Question

Describe the question/requirement as clearly as possible.

Failed to log in for the first time after installation

LOG： 2022-03-04 17:02:38,235 [ERROR] from org.thp.scalligraph.models.Database in application-akka.actor.default-dispatcher-13 [00000006|5a066f19] Exception raised, rollback (User not found) 2022-03-04 17:02:38,238 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-13 [00000006|5a066f19] local fails: org.thp.scalligraph.AuthenticationError: Authentication failure 2022-03-04 17:02:38,241 [INFO] from org.thp.scalligraph.AccessLogFilter in application-akka.actor.default-dispatcher-13 [00000006|] 100.121.135.17 POST /api/login took 133ms and returned 401 65 bytes 2022-03-04 17:06:50,194 [ERROR] from org.thp.scalligraph.traversal.TraversalOps in application-akka.actor.default-dispatcher-17 [00000007|4d7e8221] ObservableType 4144 doesn't comply with its schema, field login is missing: v[4144]

• _label = ObservableType
• _createdBy = system@thehive.local
• _createdAt = Thu Mar 03 19:38:49 CST 2022
• name = url
• isAttachment = false 2022-03-04 17:06:50,195 [ERROR] from org.thp.scalligraph.traversal.TraversalOps in application-akka.actor.default-dispatcher-17 [00000007|4d7e8221] ObservableType 4144 doesn't comply with its schema, field locked is missing: v[4144]
• _label = ObservableType
• _createdBy = system@thehive.local
• _createdAt = Thu Mar 03 19:38:49 CST 2022
• name = url
• isAttachment = false 2022-03-04 17:06:50,200 [ERROR] from org.thp.scalligraph.utils.Retry in application-akka.actor.default-dispatcher-17 [00000007|390b42ca] uncaught error, not retrying org.thp.scalligraph.NotFoundError: User not found at org.thp.scalligraph.traversal.TraversalOps$TraversalOpsDefs.getOrFail(TraversalOps.scala:145) at org.thp.thehive.services.LocalPasswordAuthSrv.$anonfun$isValidPassword$3(LocalPasswordAuthSrv.scala:68) at org.thp.scalligraph.janus.JanusDatabase.$anonfun$tryTransaction$7(JanusDatabase.scala:241) at scala.util.Try$.apply(Try.scala:213) at org.thp.scalligraph.janus.JanusDatabase.$anonfun$tryTransaction$6(JanusDatabase.scala:241) at scala.util.Try$.apply(Try.scala:213) at org.thp.scalligraph.utils.DelayRetry.withTry(Retry.scala:93) at org.thp.scalligraph.janus.JanusDatabase.tryTransaction(JanusDatabase.scala:238) at org.thp.thehive.services.LocalPasswordAuthSrv.isValidPassword(LocalPasswordAuthSrv.scala:63) at org.thp.thehive.services.LocalPasswordAuthSrv.$anonfun$authenticate$2(LocalPasswordAuthSrv.scala:94) at org.thp.thehive.services.LocalPasswordAuthSrv.$anonfun$authenticate$2$adapted(LocalPasswordAuthSrv.scala:94) at scala.util.Success.filter(Try.scala:263) at org.thp.thehive.services.LocalPasswordAuthSrv.authenticate(LocalPasswordAuthSrv.scala:94) at org.thp.scalligraph.auth.MultiAuthSrv.$anonfun$authenticate$1(MultiAuthSrv.scala:89) at org.thp.scalligraph.auth.MultiAuthSrv.$anonfun$forAllAuthProviders$1(MultiAuthSrv.scala:59) at scala.collection.LinearSeqOptimized.foldLeft(LinearSeqOptimized.scala:126) at scala.collection.LinearSeqOptimized.foldLeft$(LinearSeqOptimized.scala:122) at scala.collection.immutable.List.foldLeft(List.scala:91) at org.thp.scalligraph.auth.MultiAuthSrv.forAllAuthProviders(MultiAuthSrv.scala:56) at org.thp.scalligraph.auth.MultiAuthSrv.authenticate(MultiAuthSrv.scala:89) at org.thp.thehive.services.TOTPAuthSrv.authenticate(TOTPAuthSrv.scala:65) at org.thp.thehive.controllers.v0.AuthenticationCtrl.$anonfun$login$1(AuthenticationCtrl.scala:42) at org.thp.scalligraph.controllers.Entrypoint$EntryPointBuilder.$anonfun$apply$2(Entrypoint.scala:155) at org.thp.scalligraph.DiagnosticContext$.$anonfun$withRequest$2(ContextPropagatingDisptacher.scala:102) at org.thp.scalligraph.DiagnosticContext$.saveDiagnosticContext(ContextPropagatingDisptacher.scala:108) at org.thp.scalligraph.DiagnosticContext$.withRequest(ContextPropagatingDisptacher.scala:99) at org.thp.scalligraph.controllers.Entrypoint$EntryPointBuilder.$anonfun$apply$1(Entrypoint.scala:155) at org.thp.scalligraph.controllers.Entrypoint$EntryPointBuilder.$anonfun$async$3(Entrypoint.scala:169) at org.scalactic.Good.fold(Or.scala:1229) at org.thp.scalligraph.controllers.Entrypoint$EntryPointBuilder.$anonfun$async$2(Entrypoint.scala:169) at org.thp.scalligraph.DiagnosticContext$.$anonfun$withRequest$2(ContextPropagatingDisptacher.scala:102) at org.thp.scalligraph.DiagnosticContext$.saveDiagnosticContext(ContextPropagatingDisptacher.scala:108) at org.thp.scalligraph.DiagnosticContext$.withRequest(ContextPropagatingDisptacher.scala:99) at org.thp.scalligraph.controllers.Entrypoint$EntryPointBuilder.$anonfun$async$1(Entrypoint.scala:169) at play.api.mvc.ActionBuilderImpl.invokeBlock(Action.scala:441) at play.api.mvc.ActionBuilderImpl.invokeBlock(Action.scala:439) at play.api.mvc.ActionBuilder$$anon$9.apply(Action.scala:379) at play.api.mvc.Action.$anonfun$apply$4(Action.scala:82) at play.api.libs.streams.StrictAccumulator.$anonfun$mapFuture$4(Accumulator.scala:168) at scala.util.Try$.apply(Try.scala:213) at play.api.libs.streams.StrictAccumulator.$anonfun$mapFuture$3(Accumulator.scala:168) at scala.Function1.$anonfun$andThen$1(Function1.scala:57) at scala.Function1.$anonfun$andThen$1(Function1.scala:57) at scala.Function1.$anonfun$andThen$1(Function1.scala:57) at play.api.libs.streams.StrictAccumulator.run(Accumulator.scala:200) at play.core.server.AkkaHttpServer.$anonfun$runAction$4(AkkaHttpServer.scala:418) at akka.http.scaladsl.util.FastFuture$.strictTransform$1(FastFuture.scala:41) at akka.http.scaladsl.util.FastFuture$.$anonfun$transformWith$3(FastFuture.scala:51) at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:64) at org.thp.scalligraph.ContextPropagatingDispatcher$$anon$1.$anonfun$execute$2(ContextPropagatingDisptacher.scala:57) at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:23) at org.thp.scalligraph.DiagnosticContext$$anon$2.withContext(ContextPropagatingDisptacher.scala:77) at org.thp.scalligraph.ContextPropagatingDispatcher$$anon$1.$anonfun$execute$1(ContextPropagatingDisptacher.scala:57) at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:48) at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48) at java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:289) at java.util.concurrent.ForkJoinPool$WorkQueue.runTask(ForkJoinPool.java:1056) at java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1692) at java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:175) 2022-03-04 17:06:50,200 [ERROR] from org.thp.scalligraph.models.Database in application-akka.actor.default-dispatcher-17 [00000007|390b42ca] Exception raised, rollback (User not found) 2022-03-04 17:06:50,200 [WARN] from org.thp.thehive.services.TOTPAuthSrv in application-akka.actor.default-dispatcher-17 [00000007|390b42ca] local fails: org.thp.scalligraph.AuthenticationError: Authentication failure 2022-03-04 17:06:50,201 [INFO] from org.thp.scalligraph.AccessLogFilter in application-akka.actor.default-dispatcher-17 [00000007|] 100.121.135.29 POST /api/login took 21ms and returned 401 65 bytes

so，What is the reason for this， and How to solve it？

[nankopeter]

Hi, I had same issue. Remove existing indexes in "/opt/thp/thehive/index" for example with this "rm -rf /opt/thp/thehive/index/*". Next restart TheHive service. I hope it helps.