Latest Version is Throwing Spurious Authentication Failure

[Pelton]

I am using MUT 4.0.0 with on-premise Jamf version 10.3.1-t1522933524. A local account with full local admin rights, which can log into the Jamf site and also load the /api page, and which previously was able to use The Mut, now cannot be used to log into the environment. Any suggestions?

[mike-levenick]

MUT uses a GET on the /activationcode endpoint in order to test authentication. Can you please try GETing the activation code on the API page with that user?

[Pelton]

"The requested resource is not available."

[mike-levenick]

Whoops.. my apologies. Head on over to the /api page, and then click the GET on Activation Code, authenticate, and see what it gives you.

EDIT: I'm particularly interested in the response code.

If that returns a 200, I'd be curious what actual URL MUT is parsing out using your jamf pro URL. It tries to make a logical determination of the jamf pro URL, and I'm wondering if for some reason a URL like yours with all the extra dots is throwing it off.

[Pelton]

--redacted by Mike-Levenick, didn't want your activation code hanging out in the open.

[mike-levenick]

1) Do you mind me throwing your URL into MUT and attempting an authentication with the app here in debug mode in xcode? I am going to try to see what URL it's attempting to authenticate to.

2) Any crazy special characters or anything like that in the password?

3) Can you please try creating a brand new user, giving it full permissions and an alphanumeric password and seeing if it is able to authenticate?

4) If you use the authentication bypass button (be 100% sure you type your username and password correctly) and then get into MUT, and then run an update on a line or two, what response code does it spit out at you?

[mike-levenick]

Clarification on 1) I am not looking for your credentials whatsoever. Just looking for your permission to attempt an authentication against your URL (which will fail) to see if MUT is parsing your URL properly.

[mike-levenick]

@Pelton I hit you up on slack if you'd like to chat there. Or we can continue working here. Whatever works best for you.

[Pelton]

• my Jamf TAM

1.

Do you mind me throwing your URL into MUT and attempting an authentication with the app here in debug mode in xcode? I am going to try to see what URL it's attempting to authenticate to.

​I don't mind, per se; however, it's not public facing, so I think you'll find the experience um er less than rewarding.​

1. Any crazy special characters or anything like that in the password?

​semicolon​

1. Can you please try creating a brand new user, giving it full permissions and an alphanumeric password and seeing if it is able to authenticate?

​I will do that.​

1. If you use the authentication bypass button (be 100% sure you type your username and password correctly) and then get into MUT, and then run an update on a line or two, what response code does it spit out at you?

​That works​!

MUT has logically detected Serial Numbers for the unique identifier.

To override: include a header row specifying 'id' or 'serial' in Column A. Beginning Update Run! Full Response Data:

Conflict

Error: Unable to match computer

You can get technical details here.
Please continue your visit at our home page.

Device 451245YJF5W - Failed! - 409! HTTP 409 is a generic error code code. Turn on Advanced Debugging from the settings menu at the top of the screen for more information. Full Response Data:

Conflict

Error: Unable to match computer

You can get technical details here.
Please continue your visit at our home page.

Device 45124619F5W - Failed! - 409! HTTP 409 is a generic error code code. Turn on Advanced Debugging from the settings menu at the top of the screen for more information. Full Response Data:

Conflict

Error: Unable to match computer

You can get technical details here.
Please continue your visit at our home page.

Device 45124629F5W - Failed! - 409! HTTP 409 is a generic error code code. Turn on Advanced Debugging from the settings menu at the top of the screen for more information. Full Response Data:

Conflict

Error: Unable to match computer

You can get technical details here.
Please continue your visit at our home page.

Device 459451V69GU - Failed! - 409! HTTP 409 is a generic error code code. Turn on Advanced Debugging from the settings menu at the top of the screen for more information. Full Response Data: <?xml version="1.0" encoding="UTF-8"?><computer_ group>506 Device C02JD3XYDRV6 - OK! - 201 Full Response Data: <?xml version="1.0" encoding="UTF-8"?><computer_ group>506 Device C02JD3XZDRV6 - OK! - 201 Full Response Data:

Conflict

Error: Computer (ID:18362, Name:CPS_RENAME_ME) is not site-enabled for this site

You can get technical details here.
Please continue your visit at our home page.

1.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/mike-levenick/mut/issues/12#issuecomment-389591937, or mute the thread https://github.com/notifications/unsubscribe-auth/AALnT5TzCtzG-aoRwtkC9z1sJD1JKVt5ks5tzFr1gaJpZM4UBqAe .

[mike-levenick]

• So, it looks like it's parsing your URL properly. I'm guessing it's the semi-colon. Is it pulling the serial numbers properly? I'm surprised it's throwing a 409 and not 404 if it's unable to match computer.. but the last few lines seem to work properly.

• I'll look into special characters in passwords. MUT base 64 encodes the string "user:password", which SHOULD help with special characters like semi-colons, but perhaps not in this situation. I'd be curious as to the results of the new user with alphanumeric only password.

• Is: 45124629F5W a real device serial? Or is MUT parsing incorrectly on those lines?

[Pelton]

It appears to be pulling serials correctly; 45124629F5W is a MacBook (13-inch, Mid 2010). It is probably failing because the device was never enrolled.

The problem is the semi-colon: when I change the password to not have that character, things work swimmingly.

[mike-levenick]

Awesome. I'll do some digging and see if there is a way for me to re-encode the information to allow special characters to work better. Some are working correctly now, like I use a . or a ! in some of my passwords and they are ok, but others apparently still break it.

What's really interesting is that it is able to pass the data properly after authenticating.. like the updates are working, which means it's passing the data correctly, even with the semi-colon in the password. I'll do a diff on my GET and my PUT functions and see if they are handling credentials differently.