topic Re: Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore? in Getting Data In

Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

tokio13 — Fri, 25 Feb 2022 18:17:02 GMT

Hello,

I'm experiencing some issues on kvstore:

[conn4556] SCRAM-SHA-1 authentication failed for __system on local from client xxx.xxx.x.xx:xxxxx ; AuthenticationFailed: SCRAM-SHA-1 authentication failed, storedKey mismatch

I followed this https://community.splunk.com/t5/Deployment-Architecture/Why-is-the-KV-Store-status-is-showing-as-quot-starting-quot-in/m-p/284690 as for 1SH (total of 3) I'm reciving:

This member:

backupRestoreStatus : Ready disabled : 0 guid : xxxxxxxxxxxxxxxxxxxxxx port : 8191 standalone : 0 status : starting storageEngine : mmapv1

I appreciate any help

Re: Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

NK — Wed, 19 Jul 2023 16:33:02 GMT

I'm seeing the same message logged in mongod.log with Splunk v8.2.10 running on Windows Server.

It is logged as Info ("I ACCESS") instead of Error ("E ACCESS"), so maybe it can be ignored?

Not sure which location "storedKey" it is referring to:

The expired Splunk local certificate was renewed a few months ago (server.pem), but there was still an old copy residing in Windows' certlm.msc repository. Updating the latter doesn't appear to fix the issue.

Environment Variable SSL_CERT_FILE pointing to server.pem doesn't help either.

Re: Why are we getting an error "SCRAM-SHA-1 authentication failed" on kvstore?

trashyroadz — Sat, 22 Jul 2023 13:45:53 GMT

Are you using a custom certificate, and is it secured with a password? This error suggests an incorrect password, or possibly the password uses special characters and mongod doesn't like them. I found a case where someone using mongod and logging in from the command line had to escape out the special characters in their password. I don't see how that would be an issue with Splunk's implementation o mongod, but might be a good thing to test.

In the meantime, I will continue researching as I am working with another Splunk user encountering the same message.