KB-2227 401 unauthorized error caused by apiKey mismatch

Symptoms

When starting up the search server after an upgrade, the following errors appear:

In tomcat-stdOut.log:

method [GET], host http://localhost:9200, URI [/_nodes/http?timeout=1000ms], status line [HTTP/1.1 401 Unauthorized]

com.appiancorp.common.persistence.search.AppianSearchSpringConfig - error initializing client

In search-server.log:

fetching geoip databases overview from [https://geoip.elastic.co/v1/database?elastic_geoip_service_tos=agree] exception during geoip databases update java.net.SocketTimeoutException: connect timed out

Cause

There are two places for search server API key values in Appian:

The value: conf.data.search-server.restclient.apiKey in <APPIAN_HOME>/conf/custom.properties
The value: conf.search-server.http.auth.apiKey in <APPIAN_HOME>/search-server/conf/custom.properties

These keys must be the same value for the search server to function as expected.

When upgrading Appian and deploying configurations, the two API keys will match. However, the upgrade documentation points to manually copying over the old custom.properties file located at <OLD_APPIAN_HOME>/conf/ to <APPIAN_HOME>/conf/. This will overwrite the newly generated search-server apiKey value with the old search-server apiKey value.

The apiKey value in <APPIAN_HOME>/search-server/conf/custom.properties will be the newly generated API key.
The apiKey value in <APPIAN_HOME>/conf/custom.properties will be the old API key.

This issue has been reported to the Appian Product Team. The reference number for this issue is AN-215019.

Action

Ensure the values of the search server API key properties are the same in custom.properties in <APPIAN_HOME>/conf/ (via conf.data.search-server.restclient.apiKey) and custom.properties in <APPIAN_HOME>/search-server/conf/ (via conf.search-server.http.auth.apiKey). This can be done in either one of the following ways:

Copy the value from conf.data.search-server.restclient.apiKey in <APPIAN_HOME>/conf/ to conf.search-server.http.auth.apiKey in <APPIAN_HOME>/search-server/conf/.
Copy the value from conf.search-server.http.auth.apiKey in <APPIAN_HOME>/search-server/conf/ to conf.data.search-server.restclient.apiKey in <APPIAN_HOME>/conf/.

Affected Versions

This article applies to versions of Appian upgrading from 20.4 and earlier to 21.1 and later.

Last Reviewed: May 2023