{"record":{"id":"4a9530fb11dac2a2","repo":"netbirdio/netbird","slug":"foreground-login-failed-v-4a9530","errorCode":null,"errorMessage":"foreground login failed: %v","messagePattern":"foreground login failed: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/up.go","lineNumber":254,"sourceCode":"\t// DNS config (a stale resolv.conf takeover can make the management\n\t// hostname unresolvable), firewall rules, ssh config and legacy routing.\n\t// Route cleanup itself happens at engine start; nbnet.Init() below lets\n\t// the management dial bypass a leftover fwmark rule until then.\n\t// Foreground mode is particularly exposed in containers: a crashed\n\t// container restarts inside the same (pod) network namespace, so stale\n\t// state survives while the process does not.\n\tif err := server.RestoreResidualState(ctx, profilemanager.NewServiceManager(configPath).GetStatePath()); err != nil {\n\t\tlog.Warnf(\"failed to restore residual state: %v\", err)\n\t}\n\n\t// Enable advanced routing (as the daemon does on startup) so the\n\t// management dial bypasses a leftover fwmark rule instead of being\n\t// shunted into a stale routing table.\n\tnbnet.Init()\n\n\terr = foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"foreground login failed: %v\", err)\n\t}\n\n\tvar cancel context.CancelFunc\n\tctx, cancel = context.WithCancel(ctx)\n\tSetupCloseHandler(ctx, cancel)\n\n\tr := peer.NewRecorder(config.ManagementURL.String())\n\tr.GetFullStatus()\n\n\tconnectClient := internal.NewConnectClient(ctx, config, r)\n\tSetupDebugHandler(ctx, config, r, connectClient, \"\")\n\n\treturn connectClient.Run(nil, util.FindFirstLogPath(logFiles))\n}\n\nfunc runInDaemonMode(ctx context.Context, cmd *cobra.Command, pm *profilemanager.ProfileManager, activeProf *profilemanager.Profile, profileSwitched bool) error {\n\t// Check if deprecated config flag is set and show warning\n\tif cmd.Flag(\"config\").Changed && configPath != \"\" {","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/up.go#L236-L272","documentation":"Thrown by runInForegroundMode (client/cmd/up.go:254), wrapping foregroundLogin. That function performs the whole interactive/control-plane login the daemon would otherwise do: creating the auth client from the config's private key and management URL, calling IsLoginRequired, running the browser-based device-authorization SSO flow when no setup key is given, and finally authClient.Login with the setup key or JWT. Any of those steps failing lands here.","triggerScenarios":"'netbird up --foreground-mode' when management is unreachable (IsLoginRequired dial fails), the browser SSO flow times out or is canceled, an expired/invalid --setup-key is used, the private key in the config cannot be loaded, or TLS verification against management fails.","commonSituations":"Containers without a browser where the SSO flow cannot complete; expired setup keys; management behind a proxy with an untrusted certificate; clock skew breaking TLS and JWT validation.","solutions":["Verify management reachability from the host (curl -v https://<management-url>) and fix DNS/firewall/TLS trust","Use a fresh setup key: 'netbird up --foreground-mode --setup-key <key>' (valid, non-expired, from the admin UI)","For SSO, complete the opened verification URL before the flow expires, or use --setup-key in headless environments","Check host clock (NTP) - skew breaks certificate and token validation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if _, err := net.DialTimeout(\"tcp\", urlHost(config.ManagementURL), 3*time.Second); err != nil {\n    log.Warnf(\"management unreachable before login attempt: %v\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := foregroundLogin(ctx, cmd, config, providedSetupKey, activeProf.ID); err != nil {\n    if strings.Contains(err.Error(), \"setup key\") || strings.Contains(err.Error(), \"login failed\") {\n        // credentials problem: do not retry, ask for a fresh setup key\n        return fmt.Errorf(\"foreground login failed (credential issue): %w\", err)\n    }\n    // transport/SSO issues are often transient: safe to retry after fixing reachability\n    return fmt.Errorf(\"foreground login failed: %w\", err)\n}","preventionTips":["Use setup keys for headless foreground runs; browser SSO needs an interactive session","Verify management reachability and TLS trust before foreground login","Rotate setup keys before expiry and sync host clocks via NTP"],"tags":["cli","foreground","auth","sso","setup-key","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}