{"record":{"id":"17462dcd963e2bc6","repo":"crowdsecurity/crowdsec","slug":"machine-s-attempted-to-auth-with-password-but-it","errorCode":null,"errorMessage":"machine %s attempted to auth with password but it is configured to use %s","messagePattern":"machine (.+?) attempted to auth with password but it is configured to use (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":161,"sourceCode":"\tret.machineID = *loginInput.MachineID\n\tpassword := *loginInput.Password\n\tret.scenariosInput = loginInput.Scenarios\n\n\tret.clientMachine, err = j.DbClient.Ent.Machine.Query().\n\t\tWhere(machine.MachineId(ret.machineID)).\n\t\tFirst(ctx)\n\tif err != nil {\n\t\tlog.Infof(\"Error machine login for %s : %+v \", ret.machineID, err)\n\t\treturn nil, err\n\t}\n\n\tif ret.clientMachine == nil {\n\t\tlog.Errorf(\"Nothing for '%s'\", ret.machineID)\n\t\treturn nil, jwt.ErrFailedAuthentication\n\t}\n\n\tif ret.clientMachine.AuthType != types.PasswordAuthType {\n\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with password but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t}\n\n\tif !ret.clientMachine.IsValidated {\n\t\treturn nil, fmt.Errorf(\"machine %s not validated\", ret.machineID)\n\t}\n\n\tif err := bcrypt.CompareHashAndPassword([]byte(ret.clientMachine.Password), []byte(password)); err != nil {\n\t\treturn nil, jwt.ErrFailedAuthentication\n\t}\n\n\treturn &ret, nil\n}\n\nfunc (j *JWT) Authenticator(c *gin.Context) (any, error) {\n\tvar (\n\t\terr  error\n\t\tauth *authInput\n\t)","sourceCodeStart":143,"sourceCodeEnd":179,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L143-L179","documentation":"authPlain resolved the machine in the DB, but its stored auth_type is not 'password', so password login is refused. CrowdSec pins each machine to the auth method it was registered with (password vs tls) to prevent downgrade/upgrade confusion.","triggerScenarios":"Authenticator -> authPlain: correct machine_id/password lookup succeeds but ret.clientMachine.AuthType != types.PasswordAuthType — the machine row was created via TLS auto-registration, and the client now tries password credentials (e.g. api client credentials in config pointing at a cert-enrolled machine).","commonSituations":"Agent was enrolled with 'cscli machines add --interactive' with certs or auto-registered via TLS, then local_api_credentials.yaml is used to log in with a password; config management flips the agent from cert auth back to password auth; copying credentials between hosts.","solutions":["Re-register the machine for password auth: cscli machines delete <machineID> && cscli machines add <machineID> --password <pw>","Or switch the client back to TLS cert auth instead of using local_api_credentials.yaml","Standardize enrollment in your automation: pick password OR tls per machine and never mix","Check 'cscli machines list' — the Auth Type column shows what the server expects"],"exampleFix":"// before: machine exists with tls auth, client uses password creds\n// on LAPI host:\ncscli machines delete myagent\ncscli machines add myagent --password 'S3cret' --force\n// then on the agent, regenerate local_api_credentials.yaml","handlingStrategy":"validation","validationCode":"// confirm the machine's auth type before using password credentials\nout, _ := exec.Command(\"cscli\", \"machines\", \"list\", \"-o\", \"json\").Output()\nvar machines []struct {\n    MachineID string `json:\"machineId\"`\n    AuthType  string `json:\"authType\"`\n}\njson.Unmarshal(out, &machines)\nfor _, m := range machines {\n    if m.MachineID == \"myagent\" && m.AuthType != \"password\" {\n        log.Fatalf(\"machine %s uses %s auth; password login will be refused\", m.MachineID, m.AuthType)\n    }\n}","typeGuard":null,"tryCatchPattern":"_, err := client.Login(ctx)\nif err != nil && strings.Contains(err.Error(), \"attempted to auth with password\") {\n    return fmt.Errorf(\"machine is cert-registered; use TLS auth or re-enroll with password: %w\", err)\n}","preventionTips":["Match local_api_credentials.yaml usage to how the machine was enrolled (password vs TLS)","Re-enroll (delete + cscli machines add) whenever switching auth methods","Audit 'cscli machines list' after automation runs to catch auth-type drift","Avoid copying local_api_credentials.yaml between hosts with different enrollment methods"],"tags":["auth","password","machines","config"],"backgroundTag":"auth-type-mismatch","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}