What causes "ErrorBadLoginPassword" in Dolibarr/dolibarr?

Verify the username/password and re-enter them.

ErrorBadLoginPassword

Error message

ErrorBadLoginPassword

What it means

No authentication mode succeeded in validating the username/password/entity combination, and no more specific message was set by checkLoginPassEntity or its subfunctions, so Dolibarr stores the generic ErrorBadLoginPassword message. This is the standard wrong-credentials outcome of the login flow.

Solutions

Verify the username/password and re-enter them.
Check the correct entity/company is selected on multi-entity installs.
Confirm the account is enabled and not expired (user card in admin).
Validate $dolibarr_main_authentication and its backend (LDAP/HTTP) works.
Check the security audit/trigger logs to distinguish a typo from a backend failure.

Defensive patterns

Strategy: retry

Prevention

Use the forgot-password flow instead of repeated attempts (lockout/audit)
Test LDAP/auth backends separately with a CLI check before pointing users at them
On multicompany, document which entity users must select

When it happens

Trigger: POSTed username/password do not match any user for the requested entity under the configured authmodes (dolibarr, ldap, http, oauth...); checkLoginPassEntity returns failure without setting dol_loginmesg.

Common situations: Users typing wrong passwords or having expired/disabled accounts; wrong entity (multicompany) selection; auth mode misconfiguration (e.g. LDAP bind issues surfacing as bad login); users migrated between entities.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/98b4c9237b8e8a65. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/main.inc.php:830

					$datesecond = dol_stringtotime($dol_dst_second);
					if ($datenow >= $datefirst && $datenow < $datesecond) {
						$dol_dst = 1;
					}
				}
				$dol_screenheight = empty($_POST["screenheight"]) ? (empty($_GET["screenheight"]) ? (empty($_SESSION["dol_screenheight"]) ? '' : $_SESSION["dol_screenheight"]) : (int) $_GET["screenheight"]) : $_POST["screenheight"];
				$dol_screenwidth = empty($_POST["screenwidth"]) ? (empty($_GET["screenwidth"]) ? (empty($_SESSION["dol_screenwidth"]) ? '' : $_SESSION["dol_screenwidth"]) : (int) $_GET["screenwidth"]) : $_POST["screenwidth"];
				//print $datefirst.'-'.$datesecond.'-'.$datenow.'-'.$dol_tz.'-'.$dol_tzstring.'-'.$dol_dst.'-'.sdol_screenheight.'-'.sdol_screenwidth; exit;
			}

			if (!$login) {
				dol_syslog('Bad password, connection refused (see a previous notice message for more info)', LOG_NOTICE);
				// Load translation files required by page
				$langs->loadLangs(array('main', 'errors'));

				// Bad password. No authmode has found a good password.
				// We set a generic message if not defined inside function checkLoginPassEntity or subfunctions
				if (empty($_SESSION["dol_loginmesg"])) {
					$_SESSION["dol_loginmesg"] = $langs->transnoentitiesnoconv("ErrorBadLoginPassword");
				}

				// Call trigger for the "security events" log
				$user->context['audit'] = $langs->trans("ErrorBadLoginPassword").' - login='.GETPOST("username", "alpha", 2);

				// Call trigger
				$result = $user->call_trigger('USER_LOGIN_FAILED', $user);
				if ($result < 0) {
					$error++;
				}
				// End call triggers

				// Hooks on failed login
				$action = '';
				$hookmanager->initHooks(array('login'));
				$parameters = array('dol_authmode' => $dol_authmode, 'dol_loginmesg' => $_SESSION["dol_loginmesg"]);
				$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks
				if ($reshook < 0) {

View on GitHub (pinned to 598aa4bdad)