Wazuh Dashboard "Invalid Credentials" API Connection Error (Wazuh 4.12)
193 views
Skip to first unread message
Chilufya Mwape
Jul 29, 2025, 4:09:05 AM7/29/25
to Wazuh | Mailing List
Hello Wazuh Community,
I'm encountering a persistent issue with my Wazuh Dashboard (version 4.12.0) where it fails to connect to the Wazuh Manager API, consistently showing an "Invalid Credentials" error (specifically, error 3099). This prevents me from seeing any agent or log data within the dashboard, as it's redirected to the API connection error page upon login.
Here's a summary of my setup and what I've tried so far:
My Setup:
Wazuh Version: 4.12.0
Operating System: Ubuntu 22.04 LTS
Issue: Dashboard displays "API connections could be down or inaccessible. The errors in the image show: 3099 - ERROR3099 - Invalid credentials and Invalid credentials."
What I've Already Tried (Troubleshooting Steps):
Service Status Verification:
sudo systemctl status wazuh-dashboard: Reports active (running).
sudo systemctl status wazuh-manager: Reports active (running).
sudo systemctl status wazuh-indexer: Reports active (running).
ps aux | grep wazuh-apid: Confirms the API process is running on the Manager.
Dashboard Logs: journalctl -u wazuh-dashboard shows statusCode:401 responses from API calls, confirming the authentication failure from the dashboard's perspective. Also seeing errors related to cron-scheduler that seem to be a consequence of the main API issue.
wazuh-wui Password Reset & Configuration:
I've used wazuh-passwords-tool.sh on the Wazuh Manager to reset the wazuh-wui user's password, using the wazuh admin password.
I have then manually updated the password field in /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml on the Dashboard server with the exact new plaintext password obtained from the reset.
I've double-checked for typos, leading/trailing spaces, and proper quoting in wazuh.yml.
Confirmed the url and port (55000) in wazuh.yml correctly point to the Wazuh Manager's IP/hostname.
After each wazuh.yml modification, I've restarted the wazuh-dashboard service.
Network/Firewall Checks:
From the Dashboard server, telnet <Wazuh_Manager_IP> 55000 connects successfully, indicating the port is open and reachable.
Firewalls on both the Dashboard and Manager have been checked for blocks on port 55000/TCP.
Request for Assistance:
Despite these steps, the "Invalid Credentials" error persists. It appears the wazuh-wui user configured in wazuh.yml is still not authenticating successfully with the Wazuh Manager API.
Could anyone offer further troubleshooting steps or insights into why the Manager API might be rejecting these credentials, even after resetting and carefully configuring them? Are there specific Manager-side API logs I should scrutinize more closely, or permissions/roles that might be misconfigured for wazuh-wui? is there are way I can update the API passwords so that they work or can I add a new API profile so that the dashboard and the API manager can communicate? I have attached screenshots of my errors.
Any guidance would be greatly appreciated.
Thank you, Chilufya
I'm encountering a persistent issue with my Wazuh Dashboard (version 4.12.0) where it fails to connect to the Wazuh Manager API, consistently showing an "Invalid Credentials" error (specifically, error 3099). This prevents me from seeing any agent or log data within the dashboard, as it's redirected to the API connection error page upon login.
Here's a summary of my setup and what I've tried so far:
My Setup:
Wazuh Version: 4.12.0
Operating System: Ubuntu 22.04 LTS
Issue: Dashboard displays "API connections could be down or inaccessible. The errors in the image show: 3099 - ERROR3099 - Invalid credentials and Invalid credentials."
What I've Already Tried (Troubleshooting Steps):
Service Status Verification:
sudo systemctl status wazuh-dashboard: Reports active (running).
sudo systemctl status wazuh-manager: Reports active (running).
sudo systemctl status wazuh-indexer: Reports active (running).
ps aux | grep wazuh-apid: Confirms the API process is running on the Manager.
Dashboard Logs: journalctl -u wazuh-dashboard shows statusCode:401 responses from API calls, confirming the authentication failure from the dashboard's perspective. Also seeing errors related to cron-scheduler that seem to be a consequence of the main API issue.
wazuh-wui Password Reset & Configuration:
I've used wazuh-passwords-tool.sh on the Wazuh Manager to reset the wazuh-wui user's password, using the wazuh admin password.
I have then manually updated the password field in /usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml on the Dashboard server with the exact new plaintext password obtained from the reset.
I've double-checked for typos, leading/trailing spaces, and proper quoting in wazuh.yml.
Confirmed the url and port (55000) in wazuh.yml correctly point to the Wazuh Manager's IP/hostname.
After each wazuh.yml modification, I've restarted the wazuh-dashboard service.
Network/Firewall Checks:
From the Dashboard server, telnet <Wazuh_Manager_IP> 55000 connects successfully, indicating the port is open and reachable.
Firewalls on both the Dashboard and Manager have been checked for blocks on port 55000/TCP.
Request for Assistance:
Despite these steps, the "Invalid Credentials" error persists. It appears the wazuh-wui user configured in wazuh.yml is still not authenticating successfully with the Wazuh Manager API.
Could anyone offer further troubleshooting steps or insights into why the Manager API might be rejecting these credentials, even after resetting and carefully configuring them? Are there specific Manager-side API logs I should scrutinize more closely, or permissions/roles that might be misconfigured for wazuh-wui? is there are way I can update the API passwords so that they work or can I add a new API profile so that the dashboard and the API manager can communicate? I have attached screenshots of my errors.
Any guidance would be greatly appreciated.
Thank you, Chilufya
Reply all
Reply to author
Forward
0 new messages