login not work with otp

[alifrd]

I encountered a problem with OTP authentication on a 3-node Warpgate deployment using an external MariaDB master–replica backend.
OTP setup works and the database tables (credentials_otp and credentials_password) update correctly, but just two random user created successfully authenticate with OTP; any additional users fail OTP login even though they are prompted for the code and the OTP secret is correctly created.
i upgrade to 0.17 to hope this issue maybe resolved ... do you have any idea what happend?

cant login:

but this user work fine..

this issue related to this ?
#1456

[alifrd]

[vinhjaxt]

Same problem here, check TZ enviroment variable, must be same as your Google Authentication Timezone.
If use docker, you can add:

    environment:
     - TZ=Asia/Ho_Chi_Minh

Where Asia/Ho_Chi_Minh is your timezone.
It works for me!

[SD321-GYHS]

Hello,

Same problem here.
I tried it in native mode (Debian 13) and in Docker (with and without the TZ environment variable set).

<Enter Login/Password>
warpgate-1  | 15:21:25 ERROR HTTP: Auth rejected
warpgate-1  | 15:21:25  WARN HTTP: Request failed method=POST url=https://***:8888/@warpgate/api/auth/login status=401 Unauthorized client_ip=::ffff:172.***
warpgate-1  | 15:21:32  INFO HTTP: Request method=GET url=https://[::]:8888/@warpgate/api/info status=200 OK client_ip=::1
warpgate-1  | 15:21:32  WARN CookieHostMiddleware: Setting session cookie domain to request host: [::] (no base domain configured). This may prevent SSO from working across subdomains. Consider setting 'external_host' in config.
warpgate-1  | 15:21:44  WARN HTTP: Invalid OTP for user ***
warpgate-1  | 15:21:44  WARN HTTP: Request failed method=POST url=https://***:8888/@warpgate/api/auth/otp status=401 Unauthorized client_ip=::ffff:172.***
warpgate-1  | 15:22:02  INFO HTTP: Request method=GET url=https://[::]:8888/@warpgate/api/info status=200 OK client_ip=::1
warpgate-1  | 15:22:02  WARN CookieHostMiddleware: Setting session cookie domain to request host: [::] (no base domain configured). This may prevent SSO from working across subdomains. Consider setting 'external_host' in config.

Without OTP :

<Enter Login/Password>
warpgate-1  | 15:25:10  INFO HTTP: Authenticated username=*** credentials=password
warpgate-1  | 15:25:10  INFO HTTP: Authenticated username=*** credentials=password
warpgate-1  | 15:25:10  INFO HTTP: Request method=POST url=https://***:8888/@warpgate/api/auth/login status=201 Created client_ip=::ffff:172.***
warpgate-1  | 15:25:10  INFO HTTP: Request method=GET url=https://***:8888/@warpgate/api/info status=200 OK client_ip=::ffff:172.*** session=12efa2c7-3304-4de9-aed1-403a6ba8d17d session_username=*** client_ip=::ffff:172.***
warpgate-1  | 15:25:10  INFO HTTP: Authenticated username=*** credentials=password session=12efa2c7-3304-4de9-aed1-403a6ba8d17d session_username=*** client_ip=::ffff:172.***
warpgate-1  | 15:25:10  INFO HTTP: Request method=GET url=https://***:8888/@warpgate/api/auth/web-auth-requests status=200 OK client_ip=::ffff:172.*** session=12efa2c7-3304-4de9-aed1-403a6ba8d17d session_username=*** client_ip=::ffff:172.***
<Connected>

Same problem with SSH:

<SSH side>
ssh "***:***@***" -p 2222
Two-factor authentication
(***:***@***) One-time password: 258303
Two-factor authentication
(***:***@***) One-time password: 566805
Two-factor authentication
(***:***@***) One-time password:

<Log side>
warpgate-1  | 15:33:50  INFO SSH: Keyboard-interactive auth as <*** for ***> session=e185ef20-6c90-4437-b66e-a367d38f02c0 client_ip=::ffff:172.***
warpgate-1  | 15:33:53  INFO SSH: Keyboard-interactive auth as <*** for ***> session=e185ef20-6c90-4437-b66e-a367d38f02c0 client_ip=::ffff:172.***
warpgate-1  | 15:34:12  INFO SSH: Keyboard-interactive auth as <*** for ***> session=e185ef20-6c90-4437-b66e-a367d38f02c0 client_ip=::ffff:172.***

timedatectl
               Local time: Fri 2026-02-20 15:36:32 CET
           Universal time: Fri 2026-02-20 14:36:32 UTC
                 RTC time: Fri 2026-02-20 14:36:32
                Time zone: Europe/Brussels (CET, +0100)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

Date/time is correct (Same as my computer and my OTP app)
I also tried with standard TZ (UTC, UTC-8)

docker run --rm -it -v /var/docker/warpgate/data:/data ghcr.io/warp-tech/warpgate version
warpgate v0.20.2-modified