401 Unauthorized Error Direct Documentation Link

Where you see ORGANIZATION, SERVER, or USERNAME, substitute in your own respective values.

Failed to authenticate as ORGANIZATION-validator 

If you’re receiving an error like the following it most likely means you’ll need to regenerate the ORGANIZATION-validator.pem file:

INFO: Client key /etc/chef/client.pem is not present - registering
INFO: HTTP Request Returned 401 Unauthorized: Failed to authenticate as ORGANIZATION-validator. Ensure that your node_name and client key are correct.
FATAL: Stacktrace dumped to c:/chef/cache/chef-stacktrace.out
FATAL: Net::HTTPClientException: 401 "Unauthorized"

Troubleshooting Steps

1. Check if the ORGANIZATION-validator.pem file exists in one of the following locations:

   ~/.chef
   ~/projects/current_project/.chef
   /etc/chef
   

   If one is present, verify that it has the correct read permissions.

2. If there’s no ORGANIZATION-validator.pem file, you will need to regenerate your ORGANIZATION-validator.pem. Ensure your knife profile is currently accessing the organisation of which you wish to reset the validator key.

   root@chef-workstation:/home/workstation-user# knife client create new-org-validator --validator -f ./new-org-validator.pem -d
   Created client[new-org-validator]
   
   #The new org validator key will be created in your current working directory, with the file name new-org-validator.pem

Failed to Authenticate to SERVER/ORGANIZATION as USERNAME

When the values for certain settings in the client.rb file—node_name and client_key—are incorrect, it will not be possible to authenticate to the Chef Infra Server. An error similar to the following is shown:

ERROR: Failed to authenticate to https://api.opscode.com/organizations/ORGANIZATION as USERNAME with key /path/to/USERNAME.pem
Response:  Failed to authenticate as USERNAME. Ensure that your node_name and client key are correct.

Troubleshooting Steps

• Verify you have the correct values in your config.rb file, especially for the node_name and client_key settings.

• Check if the file referenced in the client_key setting (usually USER.pem) exists. Some common locations include:

  • ~/.chef

  • ~/projects/current_project/.chef

  • /etc/chef

    If one is present, verify that it has the correct read permissions.

• If there’s no client.rb file, regenerate it and ensure the values for the node_name and client_key settings are correct.

Synchronize The Clock on Your Host

If the system clock drifts more than 15 minutes from the actual time, the following type of error will be shown:

INFO: Client key /etc/chef/client.pem is not present - registering
INFO: HTTP Request Returned 401 Unauthorized: Failed to authenticate as ORGANIZATION-validator. Synchronize the clock on your host.
FATAL: Stacktrace dumped to /var/chef/cache/chef-stacktrace.out
FATAL: Net::HTTPClientException: 401 "Unauthorized"

To resolve this error, synchronize the clock with an NTP server.

All Other 401 Errors

The general Net::HTTPClientException: 401 "Unauthorized" error will usually occur for one of two reasons.

Troubleshooting Steps

1. Make sure your client.pem is valid. This can be fixed by deleting client.pem in /etc/chef and deleting the client and node with knife. On a workstation:

   # Dump the current node to JSON
   knife node show NODE_NAME -fJ > NODE_NAME.json
   
   knife client delete FQDN -y
   knife node delete FQDN -y
   

   On an affected node (as root):

   rm /etc/chef/client.pem
   chef-client

   When Chef Infra Client runs, it will register the API client and generate the correct key. After successfully running Chef Infra Client on the node, reload the run_list and node attributes:

   knife node from file NODE_NAME.json

2. Make sure to use the same node_name as the initial Chef Infra Client run.

   This can happen for a number of reasons. For example, if the client.rb file does not specify the correct node name and the system’s hostname has changed.

   Running chef-client -l debug will identify the node name being used by Chef Infra Client for authentication attempts:

   DEBUG: Signing the request as SOME_NODE_NAME

   This can be fixed by explicitly setting node_name in the client.rb file to match the name originally used to register.

   node_node 'mynode.mycompany.com'

    

As there are multiple causes of this 401 error, we thought it best to provide each resolution following each problem description in the Question/Problem Description section.