Invalid Admin Credentials after Install

[solmarcus]

Question
Hi, I just installed Wiki.js on my server, completed the setup wizard by filling out my admin email and password, and as soon as I try to log in, I'm told I have invalid credentials. I've tried to reset the password through the database just in case and that doesn't work either. My email server is having issues, so I didn't receive any confirmation (or forgot-password) emails, but according to the database, the admin account is verified. Aside from that, I can't figure out what the cause of this may be. Any ideas? Is there a way to fix this manually without the email server being up?

Host Info:
OS: Ubuntu Linux 16.04.2
Wiki.js version: 2.0.1
Database engine: mysql 5.7.31

[NGPixel]

There's no email verification / validation for the admin account.

Try deleting the database and try again. You probably made a typo when entering your password during setup.

[GodBleak]

You probably made a typo when entering your password during setup.

This happens on the demo too. I don't think it's a case of mistyped credentials.

[solmarcus]

Can confirm - I copy/pasted my credentials from my password manager. There weren't any typos.

[bytewav]

I have the exact same bug and used a password manager too. I tried both regenerating the db or editing the password field of User using bcrypt-generator.com

Host Info:
OS: Manjaro Linux x86_64
Wiki.js version: 2.5.159
Database engine: Sqlite

[Frankstar]

can you show an example password?
like which symbols, length, and so on.

[NGPixel]

Is the email entered during the setup screen in lowercase?

[unquietwiki]

@NGPixel I'm having this problem too, and have tried using https://bcrypt-generator.com/ with different hashing rounds to create a new password. I dug into the codebase and saw your lowercase email change, but I can't find anything that says the code is supposed to handle bcrypt content like https://medium.com/silibrain/using-passport-bcrypt-for-full-stack-app-user-authentication-fe30a013604e or some unresolved issues for the library suggest others are trying to do also.

At least until I can get back into my site to do edits, the visual changes look great! 👍

[PenguinPaws]

I encountered this bug too. The workaround would be to register using lower case email address.

I wish that there was some comment on the UI that hinted at this requirement, or for there to be javascript to automatically convert that text to lowercase on submit / when going to the next textbox.

[unquietwiki]

@PenguinPaws @NGPixel I finally got back in. Here's what I ran into...

• e-Mail address was already lowercase, as suggested before.
• https://www.bcryptgenerator.com/ with 12 rounds worked for me. The source code for WikiJS explicitly mentions 12 rounds hash, and I think that might need to be added to the documentation. This other site was useful in tracking that down.
• The password may not copy-paste cleanly into a Docker/Podman command. I did try using podman exec -it YOUR-CONTAINER psql -U YOUR-DBUSER -d YOUR-DATABASE and then UPDATE users SET password = 'HASH-PASSWORD' WHERE email = 'YOUR-EMAIL';

[blueresin]

Just my 2 cents... this was extremely helpful, however I didn't use the bcryptgenerater website because when I tried putting my password in to compare with the encrypted form from the table, they didn't match. So I just copied my account's encrypted form and put in the table for the Administrator account. Then I was able to log in with the previous Administrators email address and my password and was rocking and rolling. Now I am using Windows, so I was using Putty to SSH in to the host and sh'd into the Postgres container. Also, with the way my setup was done, I couldn't use the command starting with sudo, and instead had to run the command # psql -U

[NGPixel]

You're not supposed to compare the bcrypt values as they will never be the same. That's the whole point of bcrypt. Even for the same value, the result will be completely different every time...

[lordp]

Just a note on updating the password via docker (or equivalent), I needed to escape the $ characters in the bcrypt hash for it to work (put a backslash in front of each one).