OrchardCMS/OrchardCore · error · InvalidOperationException

The username or e-mail or password provided is incorrect.

Error message

The username or e-mail or password provided is incorrect.

What it means

ValidateUserAsync verifies the supplied MetaWeblog credentials via IMembershipService.CheckPasswordAsync before any other operation. If the username/e-mail and password combination does not validate, an InvalidOperationException is thrown. This is the standard authentication gate for all MetaWeblog XML-RPC calls.

Solutions

1. Re-enter the correct username (or e-mail) and password in the remote blogging client.
2. Reset the user's password in Admin > Security > Users and update the client.
3. Verify the user account exists and is enabled.
4. Ensure the site's membership settings allow password checking for this user type.

// Validate credentials before invoking MetaWeblog calls
if (string.IsNullOrWhiteSpace(userName) || string.IsNullOrWhiteSpace(password))
    throw new ArgumentException("MetaWeblog credentials must be provided.");

try { await handler.GetUsersBlogsAsync(appKey, userName, password); }
catch (InvalidOperationException ex) when (ex.Message.Contains("username or e-mail or password"))
{ /* prompt the user to re-enter credentials */ }

When it happens

Trigger: Any MetaWeblog XML-RPC call (newPost, editPost, getPost, getRecentPosts, deletePost) with a wrong password, a nonexistent username/e-mail, or credentials for a user that cannot be resolved.

Common situations: Stale saved passwords in blogging clients after a password change; typing the e-mail in the username field with a mismatched password; users whose accounts were disabled; case/format mismatches.

Related errors

• Not authorized to delete this content
• Could not find content item
• No suitable user name can be found in the principal.
• The media path is invalid.

AI-assisted analysis of OrchardCMS/OrchardCore@4306c0717f (2026-09-13). Data as JSON: /api/errors/9069ac177408f8bf. Report an issue: GitHub.

Appendix: source

Thrown at src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs:467

        if (!await _authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem))
        {
            throw new InvalidOperationException(S["Not authorized to delete this content"].Value);
        }

        foreach (var driver in drivers)
        {
            driver.Process(contentItem.ContentItemId);
        }

        await _contentManager.RemoveAsync(contentItem);
        return true;
    }

    private async Task<ClaimsPrincipal> ValidateUserAsync(string userName, string password)
    {
        if (!await _membershipService.CheckPasswordAsync(userName, password))
        {
            throw new InvalidOperationException(S["The username or e-mail or password provided is incorrect."].Value);
        }

        var storeUser = await _membershipService.GetUserAsync(userName);

        if (storeUser == null)
        {
            return null;
        }

        return await _membershipService.CreateClaimsPrincipal(storeUser);
    }

    private async Task<XRpcStruct> CreateBlogStructAsync(XmlRpcContext context, ContentItem contentItem)
    {
        var metadata = await _contentManager.PopulateAspectAsync<ContentItemMetadata>(contentItem);

        var url = context.Url.Action(
            metadata.DisplayRouteValues["action"].ToString(),

View on GitHub (pinned to 4306c0717f)