The 10.3 => 10.4 upgrade has simply been a terrible experience so far After many, many other problems I decided to start with 10.4 from scratch with a new database and just restore a backup of all tables (but no users). Now, I tried to recreate a user for the mariabackup and found this:

https://mariadb.com/kb/en/library/mariabackup-sst-method/

It says that you are supposed to be able to use a socket authentication without any password. Great. I did this:
CREATE USER 'mysql'@'localhost' IDENTIFIED VIA unix_socket;
and this:
GRANT RELOAD, PROCESS, LOCK TABLES, REPLICATION CLIENT ON . TO 'mysql'@'localhost';
on the first node.
I can now do:
sudo -u mysql mysql -u mysql
on the first/donor node and I'm logged in. Seems to work.
Now I add this to the .cnf file on donor and joiner node:
wsrep-sst-method = mariabackup
wsrep-sst-auth = mysql:

Now, when I try to start the joiner, it fails:
Jun 20 19:41:40 tukan2 mysqld[19614]: 2019-06-20 19:41:40 0 [Warning] WSREP: 0.0 (tukan1): State transfer to 1.0 (tukan2) failed: -1 (Operation not permitted)
Jun 20 19:41:40 tukan2 mysqld[19614]: 2019-06-20 19:41:40 0 [ERROR] WSREP: gcs/src/gcs_group.cpp:gcs_group_handle_join_msg():1085: Will never receive state. Need to abort.

Not very helpful
It just to work with MariaDB 10.3, albeit with root user and a password.
Now, I cannot get it to work either way.
I always get the above error message.