Ejabberd version 17.11 - getting "Failed c2s PLAIN authentication" error message - ejabberd

Question

I have installed the Ejabberd version 17.11 in our server. After the intallation, the user is able to connect with the Ejabberd service 1st time successfully. But once the session ended by that user and if the same user tries to connect again then we are getting the below error message.
websocket|<0.574.0>) Failed c2s PLAIN authentication for user#domain from xx.xx.xxx.xxx: Invalid username or password
Note:
While closing the session by the user we are getting below messages. Is that is the reason for not able to connect after 1st time for the same user?
(websocket|<0.534.0>) Closing c2s session for user#domain/reg_agent: Connection failed: connection closed
[info] Removing any push sessions of user#domain

Answer 1

[info] Removing any push sessions of user#domain
Looking at the source code file mod_push.erl, that message is logged when the account is being removed.
So, for some reason the account is being removed. If you use anonymous authentication, accounts are removed when they logout. If you use internal or SQL auth, then you should check what other modules you have enabled that may delete an account on logout.

Answer 2

Here is my ejabberd.yml file configuration
###
###' ejabberd configuration file
###
###
##
loglevel: 4
##
##
log_rotate_size: 10485760
log_rotate_date: ""
log_rotate_count: 1
##
log_rate_limit: 100
##
hosts:
- "localhost"
- "xxxx.xxxx.com"
- "yyyy.yyyy.com"
##
###. =================
###' TLS configuration
define_macro:
'TLS_CIPHERS': "HIGH:!aNULL:!eNULL:!3DES:#STRENGTH"
'TLS_OPTIONS':
- "no_sslv3"
- "cipher_server_preference"
- "no_compression"
## 'DH_FILE': "/path/to/dhparams.pem" # generated with: openssl dhparam -out dhparams.pem 2048
##
###. ===============
###' LISTENING PORTS
##
## listen: The ports ejabberd will listen on, which service each is handled
## by and what options to start it with.
##
listen:
-
port: 5222
module: ejabberd_c2s
certfile: "/etc/ejabberd/ejabberd.pem"
starttls: true
##
## To enforce TLS encryption for client connections,
## use this instead of the "starttls" option:
##
starttls_required: true
##
## Stream compression
##
## zlib: true
##
max_stanza_size: 65536
shaper: c2s_shaper
access: c2s
-
port: 5269
module: ejabberd_s2s_in
max_stanza_size: 131072
shaper: s2s_shaper
-
port: 5280
module: ejabberd_http
request_handlers:
"/websocket": ejabberd_http_ws
"/bosh": mod_bosh
## "/pub/archive": mod_http_fileserver
web_admin: true
http_bind: true
## register: true
captcha: true
-
port: 5281
module: ejabberd_http
tls: true
certfile: "/etc/ejabberd/ejabberd.pem"
##starttls: true
request_handlers:
"/websocket": ejabberd_http_ws
"/bosh": mod_bosh
## "/pub/archive": mod_http_fileserver
web_admin: true
http_bind: true
## register: true
captcha: false
##
###. ==============
###' AUTHENTICATION
##
## auth_method: Method used to authenticate the users.
## The default method is the internal.
## If you want to use a different method,
## comment this line and enable the correct ones.
##
auth_method: internal
##
host_config:
"xxxx.xxxx.com":
auth_method: anonymous
allow_multiple_connections: true
anonymous_protocol: both
host_config:
"yyyy.yyyy.com":
auth_method: anonymous
allow_multiple_connections: true
anonymous_protocol: both
###. ==============
###' DATABASE SETUP
###. ===============
###' TRAFFIC SHAPERS
shaper:
##
## The "normal" shaper limits traffic speed to 1000 B/s
##
normal: 1000
##
## The "fast" shaper limits traffic speed to 50000 B/s
##
fast: 50000
##
## This option specifies the maximum number of elements in the queue
## of the FSM. Refer to the documentation for details.
##
max_fsm_queue: 10000
###. ====================
###' ACCESS CONTROL LISTS
acl:
##
## The 'admin' ACL grants administrative privileges to XMPP accounts.
## You can put here as many accounts as you want.
##
admin:
user:
- "xx#xxxx.xxxx.com"
- "xx#localhost"
##
## Local users: don't modify this.
##
local:
user_regexp: ""
##
##
## Loopback network
##
loopback:
ip:
- "127.0.0.0/8"
##
##
###. ============
###' SHAPER RULES
shaper_rules:
## Maximum number of simultaneous sessions allowed for a single user:
max_user_sessions: 10
## Maximum number of offline messages that users can have:
max_user_offline_messages:
- 5000: admin
- 100
## For C2S connections, all users except admins use the "normal" shaper
c2s_shaper:
- none: admin
- normal
## All S2S connections use the "fast" shaper
s2s_shaper: fast
###. ============
###' ACCESS RULES
access_rules:
## This rule allows access only for local users:
local:
- allow: local
## Only non-blocked users can use c2s connections:
c2s:
- deny: blocked
- allow
## Only admins can send announcement messages:
announce:
- allow: admin
## Only admins can use the configuration interface:
configure:
- allow: admin
## Only accounts of the local ejabberd server can create rooms:
muc_create:
- allow: local
## All users are allowed to use MUC service:
muc:
- allow
## Admins of this server are also admins of MUC service:
muc_admin:
- allow: admin
muc_log:
- allow: local
## Only accounts on the local ejabberd server can create Pubsub nodes:
pubsub_createnode:
- allow: local
## In-band registration allows registration of any possible username.
## To disable in-band registration, replace 'allow' with 'deny'.
register:
- allow
## Only allow to register from localhost
trusted_network:
- allow: all
## Do not establish S2S connections with bad servers
## If you enable this you also have to uncomment "s2s_access: s2s"
###. ================
###' DEFAULT LANGUAGE
##
## language: Default language used for server messages.
##
language: "en"
#
###. =======
###' MODULES
##
## Modules enabled in all ejabberd virtual hosts.
##
modules:
mod_adhoc: {}
mod_admin_extra: {}
mod_announce: # recommends mod_adhoc
access: announce
mod_blocking: {} # requires mod_privacy
mod_caps: {}
mod_carboncopy: {}
mod_client_state: {}
mod_configure: {} # requires mod_adhoc
## mod_delegation: {} # for xep0356
mod_disco: {}
## mod_echo: {}
## mod_irc: {}
mod_bosh: {}
mod_last: {}
## XEP-0313: Message Archive Management
## You might want to setup a SQL backend for MAM because the mnesia database is
## limited to 2GB which might be exceeded on large servers
mod_mam: {} # for xep0313, mnesia is limited to 2GB, better use an SQL backend
mod_muc:
## host: "conference.#HOST#"
access: muc_create
access_admin:
- allow: muc_admin
access_create: muc_create
access_persistent: muc_create
default_room_options:
logging: true
persistent: true
history_size: 0
mod_muc_admin: {}
## mod_muc_log: {}
mod_muc_log:
access_log: muc_create
dirtype: plain
outdir: "/data/ejabberd/muclogs"
top_link:
"http://xxxx.xxxx.com/" : "xxxx.xxxx.com"
## mod_multicast: {}
mod_offline:
access_max_user_messages: max_user_offline_messages
mod_ping: {}
## mod_pres_counter:
## count: 5
## interval: 60
mod_privacy: {}
mod_private: {}
## mod_proxy65: {}
mod_pubsub:
access_createnode: pubsub_createnode
## reduces resource comsumption, but XEP incompliant
ignore_pep_from_offline: true
## XEP compliant, but increases resource comsumption
## ignore_pep_from_offline: false
last_item_cache: false
plugins:
- "flat"
- "hometree"
- "pep" # pep requires mod_caps
## mod_push: {}
## mod_push_keepalive: {}
## mod_register:
##
## Protect In-Band account registrations with CAPTCHA.
##
## captcha_protected: true
##
## Set the minimum informational entropy for passwords.
##
## password_strength: 32
##
## After successful registration, the user receives
## a message with this subject and body.
##
## welcome_message:
## subject: "Welcome!"
## body: |-
## Hi.
## Welcome to this XMPP server.
##
## When a user registers, send a notification to
## these XMPP accounts.
##
## registration_watchers:
## - "admin1#example.org"
##
## Only clients in the server machine can register accounts
##
## ip_access: trusted_network
##
## Local c2s or remote s2s users cannot register accounts
##
## access_from: deny
## access: register
mod_roster: {}
mod_shared_roster: {}
## mod_stats: {}
## mod_time: {}
mod_vcard:
search: false
mod_vcard_xupdate: {}
## Convert all avatars posted by Android clients from WebP to JPEG
## mod_avatar: # this module needs compile option
## convert:
## webp: jpeg
mod_version: {}
mod_stream_mgmt: {}
mod_s2s_dialback: {}
mod_http_api: {}
##
##
## Enable modules management via ejabberdctl for installation and
## uninstallation of public/private contributed modules
## (enabled by default)
##
allow_contrib_modules: true

Answer 3

After added the below line in .yml config file its working fine now.
auth_use_cache: false
Also, one more thing - Can we use bosh method instead of http_bind method which was used in lower versions. We used this http_bind method for lower version browsers and iPad app which are all not supporting the WebSocket feature.