{"record":{"id":"ac1731d104bf75ec","repo":"crowdsecurity/crowdsec","slug":"machine-s-not-validated","errorCode":null,"errorMessage":"machine %s not validated","messagePattern":"machine (.+?) not validated","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/middlewares/v1/jwt.go","lineNumber":165,"sourceCode":"\tret.clientMachine, err = j.DbClient.Ent.Machine.Query().\n\t\tWhere(machine.MachineId(ret.machineID)).\n\t\tFirst(ctx)\n\tif err != nil {\n\t\tlog.Infof(\"Error machine login for %s : %+v \", ret.machineID, err)\n\t\treturn nil, err\n\t}\n\n\tif ret.clientMachine == nil {\n\t\tlog.Errorf(\"Nothing for '%s'\", ret.machineID)\n\t\treturn nil, jwt.ErrFailedAuthentication\n\t}\n\n\tif ret.clientMachine.AuthType != types.PasswordAuthType {\n\t\treturn nil, fmt.Errorf(\"machine %s attempted to auth with password but it is configured to use %s\", ret.machineID, ret.clientMachine.AuthType)\n\t}\n\n\tif !ret.clientMachine.IsValidated {\n\t\treturn nil, fmt.Errorf(\"machine %s not validated\", ret.machineID)\n\t}\n\n\tif err := bcrypt.CompareHashAndPassword([]byte(ret.clientMachine.Password), []byte(password)); err != nil {\n\t\treturn nil, jwt.ErrFailedAuthentication\n\t}\n\n\treturn &ret, nil\n}\n\nfunc (j *JWT) Authenticator(c *gin.Context) (any, error) {\n\tvar (\n\t\terr  error\n\t\tauth *authInput\n\t)\n\n\tctx := c.Request.Context()\n\n\tif c.Request.TLS != nil && len(c.Request.TLS.PeerCertificates) > 0 {","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/middlewares/v1/jwt.go#L147-L183","documentation":"This error is returned by the crowdsec LAPI's password ('plain') authentication path when a machine (agent or bouncer) that registered with the API attempts to log in with username/password, but its account has not been validated yet. New auto-registered machines must be approved (manually or automatically) before they can authenticate; IsValidated is the approval flag in the machine's DB record. Until it is set, every login attempt is rejected even if the password is correct.","triggerScenarios":"A machine registered with `cscli machines add` lacking -a/auto validation, or self-registered via the /register endpoint while api.server.auto_register was disabled or required manual approval, and the operator never ran `cscli machines validate`. The machine then retries JWT login (cscli capi/lapi login) and gets this rejection before the bcrypt password comparison.","commonSituations":"Fresh agent/bouncer enrollments where the admin generated credentials but forgot the validation step; setups with require_manual_validation enabled and no approval workflow; re-creating a machine record in the DB without setting is_validated.","solutions":["Validate the machine: `cscli machines validate <machine-name>` (run on the LAPI server).","Check `cscli machines list` — the 'validated' column must be true before the client can log in.","If many machines should be trusted automatically, enable auto-registration validation (register with a token or set auto_register with validation in the api.server config).","If the machine is unknown/unwanted, delete it with `cscli machines delete <name>` and re-register it properly."],"exampleFix":"// before: machine shows in cscli machines list as not validated, agent logs keep failing\n$ cscli machines list\nNAME      VALIDATED\nagent01   ✗\n// after\n$ cscli machines validate agent01\n$ cscli machines list\nNAME      VALIDATED\nagent01   ✓","handlingStrategy":"validation","validationCode":"out, err := exec.Command(\"cscli\", \"machines\", \"list\", \"-o\", \"json\").Output()\n// parse and check the machine's 'isValidated' field is true before configuring the agent/bouncer credentials","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"not validated\") {\n        // surface instruction to run: cscli machines validate <machine>\n    }\n}","preventionTips":["Always run `cscli machines validate <name>` right after creating a machine with `cscli machines add`.","Use `cscli machines add <name> -a` (auto-validate) or API-token registration for scripted setups.","Check the 'validated' column of `cscli machines list` during deployment checklists.","Enable auto-registration validation in api.server config when machines are provisioned en masse."],"tags":["authentication","lapi","crowdsec","machines"],"backgroundTag":"authentication-required","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}