Azure Template: can't sign in

[rob_clother]

Good morning everyone. I am having some difficulties signing into my graph database. I have set up an environment on Azure, using the template at https://azuremarketplace.microsoft.com/en-us/marketplace/apps/neo4j.neo4j-enterprise-edition?tab=Ove...

However, having gone through all of the steps, I can't connect to the database when I go to http://{configured public ip address}:7474/

I use the username neo4j, and the password I set up when I applied the Azure template (as well as the password neo4j), but I always get the error "Neo.ClientError.Security.Unauthorized: The client is unauthorized due to authentication failure.

Are there any other default passwords used by the system?

[rob_clother]

rob.clother:

en I applied the Azure template (as well as the password neo4j), but I always get the error "Neo.ClientE

Note that I can sign in using the Cypher shell -- it's just the database http://{configured public ip address}:7474/ that won't let me sign in using the bolt link. The fact that I can sign in using the Cypher shell means that I have the correct username and password.

[michael_hunger]

For the time being, can you use Neo4j Desktop and configure a "Remote Database" there with your bolt-URL?

It's probably related to some firewall rule not allowing 7474 and 7473 ports? Or configuration of the http(s)-listeners in neo4j.conf

[david_allen]

We're in the process of revising the Azure templates right now to simplify them. Right now there is a lot of optionality in the way the template gets launched, that presents some possibilities to get fouled up in the process, which is unfortunate.

When you first launch your cluster on Azure, you get to choose two auth credentials; one as an SSH key/password to log into the VMs, and the second as a Neo4j password. For the browser you should use the Neo4j password. Can you confirm this is the one you're using?

Also, try opening your browser web inspector pane, and see if there's any additional information there.

If you get an unauthorized error, that's usually a pretty clean and straightforward situation -- connectivity & firewalling is not the issue, rather neo4j just doesn't like your password.

If you could try using cypher-shell and paste the results of how you're calling it (obscuring IP and password if you like) we can try to help further.

[rob_clother]

Hi David:

Please excuse the delay: I'm working on this project in my spare time.

I've followed the steps word-for-word at https://neo4j.com/blog/deploy-neo4j-microsoft-azure-part-2/. Not once but many times. I'm unable to connect either in code, or in the browser.

[david_allen]

Hi Rob,

Could you please screenshoot the parameters you're putting in before this deploy fails?

The neo4j password for bolt is different than the admin password chosen for SSH.

If you can't get the bolt connection to work, you have the option to log in by SSH and reset the password on each node using neo4j admin tools, which you should consider. I'd like to help but I can't quite tell what's happening from the info you've provided so far.

[rob_clother]

I've tried the reinstallation process multiple times, using the same neo4j password setup. I'm using identical passwords for my admin user and my neo4j user. The admin user works, as I can SSH into my machines at ports 22000, 22001 and 22002.

This time round, I can't connect via bolt at all, either through the browser, the desktop or the Cypher shell. There isn't much network information available when I try to sign in.

[rob_clother]

I'll share all the screenshots I can.

First screen: Admin user setup.

[rob_clother]

Second screen: no SSL certificate, Latest version, 3 D2S v3 nodes. The neo4j has the same password as the admin user (previous screen). All other options set to defaults.

[rob_clother]

Summary screen.

[rob_clother]

Confirmation screen omitted. I gave my contact details.

I'll wait for the template to deploy.

[rob_clother]

And here is the resulting resource group:

[rob_clother]

Using the PIP address, here is the 7474 page....

[rob_clother]

And, pasting in the identical password from Step 2:

[rob_clother]

I also tried typing in the password manually, with the same result.

If I ssh to the PIP on ports 22000, 22001 and 22002, it lets me in with the password from Step 1.

[david_allen]

Thanks for this.

I checked through these (deprecated) templates, and the password inside the container is being set like this:

          curl --fail --silent --show-error --user neo4j:neo4j \
               --data "{\"password\": \"${NEO4J_PASSWORD}\"}" \
               --header 'Content-Type: application/json' \
               http://localhost:7474/user/neo4j/password

It's possible that this step is failing and is not being monitored as part of the deploy. This would be checkable by you if you check the init scripts for the node in the deployment.

In particular check the logs of the init scripts and see if you see this:

Failed to set neo4j password

That's just to try and figure what's going on here. If you want to resolve the issue, I would suggest first trying the default password "neo4j". My bet is that the password reset on deploy failed, and you should be able to get in with just "neo4j". If this doesn't work try the command with curl above, to reset using the password that should be present from within the machine.

If neither of these work, you might try deleting the auth files (generally they're in /var/lib/neo4j/data/dbms/auth) and then restarting. This should reset to the default password and you shouldn't lose anything else valuable if you've just launched anyway.

Sorry you're having these problems. We've finished with engineering the newer setup, we're now just pushing it through the Azure marketplace approval process. If you need a setup now, these steps above is my best recommendation. If you can wait a bit, the newer deploy process is going to be more simplified, and shouldn't have this issue to begin with.

[rob_clother]

I can already discount the first and last solutions -- I've tried using the "neo4j" password and deleting the auth files. I'll check the logs now.

[david_allen]

@ali.ince can you offer any assistance here? Ali has worked on these templates as well, and may have something else he can suggest.

[rob_clother]

Running the curl command on the 22000 node gives:

The requested URL returned error: 401

I've tried adding -u neo4j:neo4j and -u neo4j:<MyPassword> to the curl command, but the result is still the same.

I also deleted the auth files and restarted all three services; first using the command

sudo service neo4j restart

and then by restarting the VMs. Neither neo4j nor my password work now.

[jonas_rolstad]

I'm also having this problem. http://{configured public ip address}:7474/

[rob_clother]

Hi guys: is there any update on this? I'd really like to get set up on Azure ASAP. Are there any fixes or workarounds available? This issue is blocking my access to Neo4j at the moment.

[david_allen]

Update guys -- internally both @ali.ince and I tried to replicate this and failed. Above, we requested logs, but I'm not sure if you checked them or what additional hints you found there.

Partially because we can't replicate, and partially because we know that a major update is coming to the Azure marketplace soon, I've not wanted to go too deep on this. I do have a set of ARM templates and a shell script for deploying them. If you want to email me privately (david.allen@neo4j.com) I think I can get you sorted out in the short term with the approach that the Azure marketplace will take. The engineering for that is finished and it's all working in a much simpler fashion now than what you're seeing live on the marketplace, I'm just working my way through the approvals which are taking time. I'd love to give you a timeframe on when that would be live, but I can't because we don't control the approvals on the Azure side.

This newer approach is something I'd strongly recommend anyway, because what you're trying to launch with this is the Neo4j HA product, which is deprecated and the newer setup would not only be a newer version of Neo4j, but the causal cluster product, and would also come with key plugins like APOC out of the box. So basically it's all around preferable over working through this particular bug.

If you have a compelling need for HA or you don't have the ability to use azure CLI tools locally (because those would be needed to use the templates I'd send you via email) -- then in this case to continue debugging here we're really going to need you to post the full logs of these machines that are failing, so we can look further for the reason why, since we can't replicate.

[rob_clother]

Hi David -- many thanks for your offer. I will take you up on this. Apologies for not sharing the logs: to be completely honest, I wasn't sure where to find the trace. I could dig it up with your assistance (or a small hint), but it sounds like we'll just be putting needless effort into debugging a deprecated template.

[sandeepwww]

Hi @rob.clother and @david.allen. I am facing the same issue even with the 'Causal Cluster' template - https://azuremarketplace.microsoft.com/en-us/marketplace/apps/neo4j.neo4j-enterprise-causal-cluster?...

Also, can you please point to the location where the init script logs are present?
I have already emailed you to request for the latest template you mentioned. Do revert back, as I am blocked due to this issue currently.

Thanks
Sandeep

[david_allen]

Hi @sandeepwww this thread is rather old, and applies to an old method of running Azure that has changed substantially since this thread was posted. In particular the causal cluster template you're referring to works differently than the original post at the top of the page.

Can you indicate what problem you're running into and what you're trying to do?

Here's a link to where you can find the templates and automate the same approach that Azure marketplace is doing. This is more current than the top level question. https://medium.com/neo4j/how-to-automate-neo4j-deploys-on-azure-d1eaeb15b70a

[sandeepwww]

I have deployed a three-node cluster using the template I mentioned.
I was facing the same issue of Authentication for bolt://:7687.
I deleted the auth file under /var/lib/neo4j/data/dbms/auth and then i logged in neo4j Browser using default password 'neo4j', and I was able to log in.

Then I started seeing the following error: Neo.ClientError.Cluster.NotALeader: No write operations are allowed directly on this database.
I checked the conf for the cluster I logged in :

It was already in CORE mode.

After searching through some forums, I figured to do CREATE operations I had to use 'bolt+routing://' - when I tried logging in using the new password I set earlier, I again started to get Authentication failure.

I tried the following then:
SSHed into all three nodes, removed the auth files, restarted them.
Tried logging in using bolt+routing://, it prompted to reset a new password. Clicking submit again threw Authentication error.

Could you please help me in debugging this?
Also, if dbms.mode=CORE, can I not do CREATE operations using the 'bolt://'?

[david_allen]

There are multiple issues going on here.

1. CORE doesn't mean a node can handle writes; it means in the core cluster topology that the node can be either a FOLLOWER or a LEADER. Only LEADER can take writes. For more information on this, see: https://neo4j.com/docs/operations-manual/current/clustering/introduction/

2. The auth files are per node, and as of 3.5 Neo4j does not synchronize auth details across the cluster, because those bits aren't in the graph. That means that if you have 3 servers (A, B, C) and you delete the file on server A, nothing has changed about auth on server B. Generally what you should do is create the accounts like you like on one node, and then use either neo4j-cluster-rsync-auth here: (https://github.com/craigtaverner/neo4j-cluster-rsync-auth) or once you have a neo4j/admin user in place on all 3, you can use Halin (https://halin.graphapp.io) to create users and passwords once that get replicated across your cluster for you.

Ideally how this should work is that when you deploy your cluster via Azure marketplace, pick a password with no special characters, just letters and numbers, and when you launch your cluster like that, you should never touch the auth files at all or worry about this stuff -- you log in with the password you specified as part of the launch process.

Finally for more information on how querying Neo4j clusters works: https://medium.com/neo4j/querying-neo4j-clusters-7d6fde75b5b4

[sandeepwww]

Thanks David.
I think only think i did wrong was using special characters in the neo4j password - which the form prompted. Avoiding special characters fixed the sign in issue. I was able to connect and insert records.

Later, i tried to create a new db in the same cluster. I logged into one of the VM in the cluster, modified the neo4j.conf -> dbms.active_database=newgraph.db ( from original commented line which had default "graph.db").

I then restarted the neo4j service using - sudo systemctl restart neo4j

I am now facing "Connection Refused" error - tried both using cypher-shell and neo4j browser

I checked the neo4j service status -

A new folder for the db is already created after restart :

Could you please figure out why this is happening?

[david_allen]

When you create a new DB and change the configuration, you need to do so on all three nodes of the cluster.

Probably the reason you're getting connection refused is that only one machine has the new database, and the cluster can't form, because the other cluster members try to connect and realize that each machine is talking about a totally different database that's not connected to the others.

[sandeepwww]

Huh, It was a long ride. Thanks! Finally I got it working. There is still so much development-pending for scenarios in Causal Cluster.
Wrote a blog with steps. Please verify and recommend changes that I might have missed out.

Medium – 14 Nov 19

Creating a new Database in a Neo4j Causal Cluster

When you delete and change the config in a standalone instance of Neo4j, it is fairly simple. But in a causal cluster, the nodes have to…

Reading time: 2 min read