3

Fresh install of TYPO3 9.5 LTS on Ubuntu 18 host. Went smoothly, new database, everything. Made up the backend user/password & when finished, I was sent to the backend to log in.

The login page seemingly just refreshes. If I use the wrong credentials it tells me they are wrong as it should. Going to sys_log I see "user logged in from x.x.x.x" but I'm not allowed further.

The redirects actually sent to the server are:

303 POST /typo3?loginProvider=....
303 GET index.php?route=/main&token=...
200 GET /typo3/ (returns the login page)

Any ideas on what to check appreciated: I know my way around servers but I'm new to TYPO3.

Adrian Mole
  • 49,934
  • 160
  • 51
  • 83
userGreg
  • 31
  • 1
  • 3

4 Answers4

2

Typical causes for this issue are:

  • TYPO3 can't write into folder typo3temp/ (check owner and permissions)
  • Disk space or quota issues (disk space full or user exceeded its quota)
  • Cookies can not be written (check PHP settings, file/directory permissions, etc.)
  • You are trying to access the backend from different IP addresses (e.g. login from 10.10.10.1 and following requests from 10.10.10.2).

It is also recommended to check the webserver/PHP error log.

Michael
  • 645
  • 5
  • 12
  • Thx Michael, all is ok going through your list, no errors in the php logs also. I'm thinking this is an install problem, especially when coupled with my system config. I've more comments Thomas's feedback above. – userGreg Oct 16 '18 at 07:53
  • I doubt that this is an issue with the password or password hashing (e.g. Argon2) because - as you pointed out, too - you **can** login successfully, according to the sys_log and the fact, that you get an error when you enter a wrong password. Therefore, I would look into other issues with the installation. – Michael Oct 18 '18 at 04:05
2

Argon2i class is always available in TYPO3, however many php installations do not have a required library compiled into php. Thus the class will fail. If you want the most universal solution, here it is: use phppass in LocalConfiguration.php:

<?php
return [
    'BE' => [
...
        'passwordHashing' => [
            'className' => 'TYPO3\\CMS\\Core\\Crypto\\PasswordHashing\\PhpassPasswordHash'
        ],
...
User366
  • 765
  • 4
  • 9
  • And verfiy that : ` 'BE' => 'loginSecurityLevel' => 'normal' ` Unless ofcourse you explicitly installed RSA, on the install. – Toke Herkild Oct 16 '18 at 13:48
  • Thanks Dmitry, I made the change but it made no difference. I'll try and make time to debug this properly. If I find anything I'll post it. In the meantime I'm open to ideas. Thanks all. – userGreg Oct 17 '18 at 12:23
1

Does your provider support the PHP encryption argon2i? Maybe that can cause the issue to not be able to login. You need to set your TYPO3 to use another encryption like e.g. bcrypt.

Just set:

$GLOBALS['TYPO3_CONF_VARS']['BE']['passwordHashing']['className'] = \TYPO3\CMS\Core\Crypto\PasswordHashing\BcryptPasswordHash::class;

More you can see here: https://docs.typo3.org/typo3cms/CoreApiReference/ApiOverview/PasswordHashing/Index.html#configuration

Thomas Löffler
  • 5,922
  • 1
  • 14
  • 29
  • Thanks Thomas, I thought I did not have argon2 installed with my php but if I do: `password_hash('something', PASSWORD_ARGON2I);` It results in : `$argon2i$v=19$m=1024,t=2,p=2$NXdYY21OOHZkODhjSk5NZA$tJNQmq4rT5rxD/buCkD3rNqDULkys/mH6FiIaYM8C1c`. In the database the hash is stored as: `$2y$12$Ox/EFjq/pRsZqrRniEGoy.G8ydmcG3UW5Quvfq0GigOf2bintXqV6`, but I was expecting the argon format as above. I've assumed my password matched as I only get an error if I deliberately enter a wrong one, plus the sys_log says I've logged in. (excuse the formatting, I'm learning) – userGreg Oct 16 '18 at 08:10
  • Hm, weird. It's also new for me so I can't help you furthermore. I'll put your issue into Slack, maybe there are people who can help. – Thomas Löffler Oct 16 '18 at 13:28
1

Had the same problem. In my case it was this line in my AdditonalConfiguration:

'cookieDomain' => '*'

This causes the browser to reject the cookie as insecure.

I deleted this line so that cookieDomain is actually empty (check setting in InstallTool).

Tobias Gaertner
  • 1,155
  • 12
  • 30