Authentication has failed.

Report · Nov 09, 2018

I updated to CF 2018 from 2016 and getting "Authentication has Failed" error message.

Please check the logs for more details.s

coldfusion.security.SecurityManager$AuthenticationFailedException: Authentication has failed.

at coldfusion.security.SecurityManager.parseAuthInfo(SecurityManager.java:3429)

at coldfusion.tagext.security.AuthenticateTag.parseAuthUpdate(AuthenticateTag.java:397)

at coldfusion.tagext.security.AuthenticateTag.doStartTag(AuthenticateTag.java:358)

Report · Nov 09, 2018

Rohit, you leave some things unsaid. Is this happening in your app? In the cf admin? In either case, was there not more info in the error about the template name with the error, and its line number? Are you looking in the logs, as it says? Or is this what you see on screen only? The latter will be limited if you have left turned off the "robust exception information" setting in the cf admin. Speaking of admin settings, you don't say if this is a stock install of cf or if you have either modified the admin, or imported settings from your previous install. There are settings that could relate to this error. Finally, I realize your hope is just to get in. I suspect the error is cookie related, so have you tried either a different browser or using the incognito/private window feature of your browser? That may get you in, and may also stop the error from happening anymore. Finally, even if that did help, you'd want to know whether this was affecting others. Again, you should be able to know that by looking at the logs. Let us know if that gets you going or if you have more questions. /CharlieSent via the Samsung Galaxy S7 active, an AT&T 4G LTE smartphone

/Charlie (troubleshooter, carehart.org)

Report · Dec 03, 2018

Thanks for your response Charlie. I sure did miss few details. Anyhow here is extra information that may help.

This issue is only occurring in the app and NOT in the admin portal. The app was upgraded from CF2016. You are right in pointing out that the error is cookie related Although I haven't been able to figure out what exactly is causing an error.

When cookies are cleared users are able to login but after some time error occurs. If users of the site logout by deleting cookies they are able to re-login.

Full Stack Trace:

"Error","ajp-nio-8018-exec-10","12/04/18","00:59:09","SITENAME","Authentication has failed.Please check the logs for more details.s The specific sequence of files included or processed is: /var/www/html/CLIENT/docroot/Consumer/be/index.cfm, line: 1 "

coldfusion.security.SecurityManager$AuthenticationFailedException: Authentication has failed.

at coldfusion.security.SecurityManager.parseAuthInfo(SecurityManager.java:3429)

at coldfusion.tagext.security.AuthenticateTag.parseAuthUpdate(AuthenticateTag.java:397)

at coldfusion.tagext.security.AuthenticateTag.doStartTag(AuthenticateTag.java:358)

at cfforceLogin2ecfm483803353.runPage(/var/www/html/CLIENT/build/be/_includes/forceLogin.cfm:1)

at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:262)

at coldfusion.tagext.lang.IncludeTag.handlePageInvoke(IncludeTag.java:729)

at coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:565)

at coldfusion.runtime.CfJspPage._emptyTcfTag(CfJspPage.java:4082)

at cfApplication2ecfm642760319.runPage(/var/www/html/CLIENT/docroot/Consumer/be/Application.cfm:48)

at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:262)

at coldfusion.tagext.lang.IncludeTag.handlePageInvoke(IncludeTag.java:729)

at coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:565)

at coldfusion.filter.CfincludeFilter.invoke(CfincludeFilter.java:65)

at coldfusion.filter.CfincludeFilter.include(CfincludeFilter.java:33)

at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:421)

at coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:43)

at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40)

at coldfusion.filter.PathFilter.invoke(PathFilter.java:162)

at coldfusion.filter.IpFilter.invoke(IpFilter.java:45)

at coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:96)

at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:28)

at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)

at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:60)

at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)

at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)

at coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62)

at coldfusion.CfmServlet.service(CfmServlet.java:226)

at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:311)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)

at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:46)

at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:47)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)

at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)

at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)

at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)

at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)

at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:137)

at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)

at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:357)

at org.apache.coyote.ajp.AjpProcessor.service(AjpProcessor.java:426)

at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)

at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:754)

at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1376)

at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)

at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1135)

at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)

at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

at java.base/java.lang.Thread.run(Thread.java:844)

Report · Dec 04, 2018

I had the same problem upgrading from CF10 to CF2018. It seems that the functionality of the applicationToken attribute for cflogin has changed somehow in CF2018.

In CF10, my root Application.cfc was very basic and just handled logins using this cflogin setup: <cflogin applicationToken="Authorization"> ...login code...<cflogin>.

This was only used for internal logins. Public users could access the site without logins.

On my site, I had several applications that used another Application.cfc but that utilized the main login by adding this:

</cflogin>

This setup gave me a single sign-on (nice), and allowed for multiple applications without the unnecessary server overhead of one massive application. It was simple, it worked, and I liked it. I also was able to have a publicly accessible application that used a separate sign-in using a different applicationToken and cflogin code.

After migrating to CF2108, I was unable to login to any of the applications that had their own Application.cfc in their sub-directories. To fix that, I changed all the application names to the same name (effectively making everything one big application). However, after a 20 minute session timeout, I got the same error the OP Rohit S had: "Authentication has failed". I also started having JVM metaspace memory errors (probably from the increased memory overhead of one massive application). I increased the metaspace allocation, which seems to have fixed that. To deal with the "Authentication has failed" problem, I wrapped all the <cflogin> code blocks in a <cftry> block with the <cfcatch> block like this:

</cfcatch>

If a user's login has timed out, the application will redirect them to the login page to re-authenticate.

This cleared up the 500 server errors users were seeing, but isn't very satisfying. I think that the error is because of the essentially empty <cflogin> block which only runs when the user isn't logged in. I haven't tried this, but I probably could either duplicate or cfinclude the login code from the root Application.cfc and then drop the error catching, but I liked it better the way it was before. With the way it works now, I don't understand what the point of the applicationToken attribute is at all.

Hope this helps.

Report · Dec 06, 2018

Bug created with Adobe: Tracker

Adobe Community

Authentication has failed.