{"record":{"id":"95690034f06cf57d","repo":"netbirdio/netbird","slug":"check-login-required-v","errorCode":null,"errorMessage":"check login required: %v","messagePattern":"check login required: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"client/cmd/login.go","lineNumber":381,"sourceCode":"\t\t})\n\t\tif err != nil {\n\t\t\tlog.Warnf(\"failed to set active profile email: %v\", err)\n\t\t}\n\t}\n\n\treturn nil\n}\n\nfunc foregroundLogin(ctx context.Context, cmd *cobra.Command, config *profilemanager.Config, setupKey string, profileID profilemanager.ID) error {\n\tauthClient, err := auth.NewAuth(ctx, config.PrivateKey, config.ManagementURL, config)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to create auth client: %v\", err)\n\t}\n\tdefer authClient.Close()\n\n\tneedsLogin, err := authClient.IsLoginRequired(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"check login required: %v\", err)\n\t}\n\n\tjwtToken := \"\"\n\tif setupKey == \"\" && needsLogin {\n\t\ttokenInfo, err := foregroundGetTokenInfo(ctx, cmd, config, profileID)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"interactive sso login failed: %v\", err)\n\t\t}\n\t\tjwtToken = tokenInfo.GetTokenToUse()\n\t}\n\n\terr, _ = authClient.Login(ctx, setupKey, jwtToken)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"login failed: %v\", err)\n\t}\n\n\treturn nil\n}","sourceCodeStart":363,"sourceCodeEnd":399,"githubUrl":"https://github.com/netbirdio/netbird/blob/93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c/client/cmd/login.go#L363-L399","documentation":"authClient.IsLoginRequired(ctx) failed: the probe request to management (checking whether the peer's key is already registered) errored at the transport or HTTP level. Causes: management host/port unreachable, DNS resolution failure, TLS verification failure (self-signed cert not trusted by the client), or a server-side 5xx.","triggerScenarios":"Wrong management address in the profile; firewall or egress rules blocking the port; management service down or restarting; self-signed management certificate without the CA imported; system clock skew breaking TLS validity; DNS entry missing.","commonSituations":"Management instance not yet up after a restart or upgrade; Private CA not distributed to new hosts so x509 verification fails; VPN/egress changes severing the path to management; Certificates expired on a self-hosted management deployment","solutions":["Test reachability directly: curl -v https://<management-url> from the same host","Fix the address/DNS or open the firewall path to management","For self-signed deployments, import the CA on the client or issue a properly signed certificate; verify cert validity dates","Wait for management to report healthy, then retry the login"],"exampleFix":"# before\nError: check login required: Get \"https://mgr.corp/api/...\": x509: certificate signed by unknown authority\n\n# after: trust the private CA on the host, then retry\n$ sudo cp corp-root-ca.crt /usr/local/share/ca-certificates/\n$ sudo update-ca-certificates\n$ netbird login","handlingStrategy":"retry","validationCode":"// Cheap pre-flight: management must answer before asking about login\nreq, _ := http.NewRequest(http.MethodGet, config.ManagementURL, nil)\nif _, err := http.DefaultClient.Do(req); err != nil {\n    return fmt.Errorf(\"management unreachable: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"var needsLogin bool\nerr := backoff.Retry(func() error {\n    var e error\n    needsLogin, e = authClient.IsLoginRequired(ctx)\n    return e\n}, backoff.WithMaxRetries(backoff.NewConstantBackOff(time.Second), 3))\nif err != nil {\n    return fmt.Errorf(\"check login required: %w\", err)\n}","preventionTips":["Health-check management (and pre-trust private CAs) as part of host onboarding","Keep management certificates valid and monitored for expiry","Pin the management URL in configuration management so typos cannot drift in"],"tags":["auth","network","tls","dns","management","netbird"],"backgroundTag":null,"analyzedSha":"93e97f4bf1ad715072dcb3fb6cdb1763431b5a9c","analyzedAt":"2026-08-16T03:09:19.136Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}