Toolbox GUI sometimes gives "Forbidden"

[delboy1966]

I have toolbox setup to scan a number of IP Ranges using different creds, which is working fine.

I also have enabled basic authentication and set a username and password. But sometimes when I come to login and enter the username/password, I get a 403 Forbidden message on the GUI.

I know its the right username/password, because sometimes it works and sometimes it doesn't. The only way I can make this go away is to restart the glpi-agent, sometimes once, sometimes more than once before it lets me in.

Just wondered if this is a bug, and if anyone else gets it?

GLPI Agent 1.15-1

[g-bougard]

Hi @delboy1966

can you activate debug=2 and share glpi-agent log ? At least the few lines around the issue happens.

Can you confirm on which platform glpi-agent is running ? Windows ?

[delboy1966]

Hi @g-bougard

This is the last few lines when I get a forbidden message:

[Thu Oct  2 10:04:39 2025][debug] [http server] GET request /toolbox from client 10.51.228.130
[Thu Oct  2 10:04:39 2025][debug] [http server] response status 403
[Thu Oct  2 10:04:46 2025][debug] [http server] GET request /toolbox from client 10.51.228.130
[Thu Oct  2 10:04:46 2025][debug] [http server] response status 403

This was after a restart of the glpi-agent service, and it seems to have loaded everything it should have.

Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug] [server test plugin] Loading Test Server plugin configuration from /etc/glpi-agent/server-test-plugin.cfg
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug] [http server] HTTPD Test Server plugin loaded but disabled
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug] [http server] Trying to load ToolBox Server plugin
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug] [toolbox plugin] Initializing ToolBox v1.5 Server plugin...
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug] [toolbox plugin] Loading ToolBox Server plugin configuration from /etc/glpi-agent/toolbox-plugin.cfg
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load Credentials ToolBox module
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load Inventory ToolBox module
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load IpRange ToolBox module
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load MibSupport ToolBox module
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load Remotes ToolBox module
Oct 02 10:04:10 glala01lv glpi-agent[4139299]: [debug2] [toolbox plugin] Trying to load Results ToolBox module

Not very helpful I would expect.

[g-bougard]

So I can see you're indeed on linux. What distro and distro version ?

Can you tell us which web browser you're using to access toolbox ? And can you confirm if you have included your ip into httpd-trusted configuration or not ?

Can you share glpi-agent plugins configuration ? Of course, you should obfuscate "user" and "password" configuration into basic-authentication-server-plugin.cfg or basic-authentication-server-plugin.local files.

[delboy1966]

Sorry, I forgot to include the distro, its Ubuntu 22.04.5 LTS.

I'm using Chrome to access the toolbox GUI. I haven't included any httpd-trusted IPs as its on a secure network, and as you can see from the toolbox config I set forbid_not_trusted to no.

toolbox-plugin

disabled = no
url_path = /toolbox
forbid_not_trusted = no

basic-authentication-server-plugin

disabled = no
url_path_regexp = .*
port = 62354
user = <user>
password = <password>
realm = GLPI Agent
forbid_not_trusted = no

I notice someone has also enabled the proxy on that box, I assume that wouldn't cause a problem?

proxy-server-plugin

disabled = no
url_path = /proxy
port = 62354

[g-bougard]

Actually, I can't reproduce your issue. Have you any clue about how to reproduce ? For example, in how much time the problem can occur ? Do you keep a browser windows opened during that time ? Did any task run during that time on the ToolBox UI ?

[delboy1966]

Hi @g-bougard
Sorry for the delay in getting back to you, work has been busy.

I've managed to take a closer look at this, this morning.

Here are the servers we have and what they are doing.

Server 01
GLPI Agent (1.13-1)
Service running 2 days
218 jobs
GUI Forbidden message
5 Inventory tasks running
267 Waiting

Server 02
GLPI Agent (1.13-1)
Service running 5 days
179 jobs
GUI OK
8 Inventory tasks running
1 Waiting

Server 03
GLPI Agent (1.14-2)
Service running 1 week 4 days
179 jobs
GUI OK
No Inventory tasks running
1 Waiting

Server 04
GLPI Agent (1.15-1)
Service running 2 days
184 jobs
GUI Forbidden message
2 Inventory tasks running
1 Waiting

On both GLPI Servers that gave the forbidden message I was able to go to http://servername:62354 and got the GLPI page showing the version and next run date/time.

Concentrating on Server 01, I restarted the glpi-agent service, took about 90 seconds to do, I guess it had to close all the waiting and running processes. But still got the forbidden message, even after waiting 5 minutes and trying to access it again. After another 2 restarts, still got the forbidden message. I tried on both Chrome and Edge.

So I move basic-authentication-server-plugin.cfg to basic-authentication-server-plugin.cfg.bak and restarted glpi-agent again, and was able to get in OK on the GUI.

Then moved basic-authentication-server-plugin.cfg.bak back to basic-authentication-server-plugin and restarted glpi-agent. Opened a new incognito browser window went to the URL and it let me in without a login prompt. Restarted glpi-agent again and again tried a new incognito browser window and still let me in without a login prompt. I tried that another 2 times with the same result.

I'm not sure why this is happening, not sure if its my setup, although the configs on all our servers are exactly the same, apart from the toolbox.yaml file as they are all scanning different subnets.

I do need to get them all up to version 1.15-1, but I don't see that would make a difference as I already have one on that version doing the same thing. Is there a latest build of glpi-agent that has the new USM.pm and credentials-edit.tpl in it, because when I installed 1.15-1 onto Server 04 it didn't have them in it.

[g-bougard]

Hi @delboy1966

90 seconds to restart the service, this is really long and could be a symptom of a problem on the computer itself. Or maybe you restarted the service while the computer was still running a network task and it had to wait a little.

Then renaming the config, get it back and still accessing a service with the plugin disabled... unless you made a mistake while renaming back, this may be also a symptom of a computer problem. But this doesn't really give me a clue to reproduce.

Can you monitor the load on the computer while testing ? Can you confirm also these servers are all installed with the same OS ?

You can use the nightly build which includes the new USM: https://nightly.glpi-project.org/glpi-agent/

[delboy1966]

Yes, there were a lot of glpi-agent network tasks running on the 01 server, which is why it took a while to restart the process.

I've come in this morning and the 01 server has let me in, no forbidden message. I checked on the server and there are still lots of glpi-agent network tasks running and the load "load average: 0.25, 0.21, 0.19", and the glpi-agent process has not been restarted since yesterday morning when it gave me the forbidden message.

The 04 server I still get the forbidden message, and there are currently no glpi-agent network tasks running.

The 02 and 03 servers let me in fine as they did yesterday. They are all running the same O/S "Ubuntu 22.04.5 LTS".

I get its hard to reproduce, sometimes I can't do it when they start working ok.

I'd say close this issue if you want, because I don't see how we are going to get to the bottom of it. And, even if the GUI won't let me in, the assets are updating in GLPI, so the network tasks are running ok.

[g-bougard]

If you have a lot of glpi-agent process, please check, if parent process is the service. If not, check if you have a double installed glpi-agent (maybe with AppImage ou Snap package ?).

On linux, it's possible to have 2 services installed by mistake. In that case, you may be forbidden by the wrong service.

[delboy1966]

I checked that, and we only have one instance ot glpi-agent installed.

This morning I decided to do a fresh install on Ubuntu and fired up another box, then instlaled the latest nightly version of glpi-agent on it. I configured the toolbox config and also the basic authenication config, I had no configures IP Ranges, Creds, or Inventory Tasks. The box wasn't even being used my GLPI as an agent.

After configuring the configs and restarting the service, I went to the toolbox URL in Chrome. And couldn't believe I got the Forbidden message. I had no debug enabled, so set debug=2 and restarted glpi-agent. When I went to Chrome, this time it let me in, I tried to login again 5 minutes later and it still let me in. So, turned of debugging and restarted glpi-agent,, went back to Chrome and clicked on IP Ranges to configure something, and got the Forbidden message again.

So, I did the same steps again, turned debug=0, restarted glpi-agent, it let me in. Turned debug off and got forbidden. Now I think this is just a coincidence, because after the 4th time, it let me in with debug set to 0.

Its very strange. If you can't recreate it, then its something our end. So rather than you waste your time on it, and to be honest we can live with it, just close off this issue.

If it becomes a really big issue, I'll seek help again.