apache/dolphinscheduler · error · ServiceException

1300017

1300017

Error message

user's password length error

What it means

Thrown by UsersServiceImpl.updateUser when a new userPassword is supplied but CheckUtils.checkPasswordLength fails, i.e. the password length is outside the policy (too short, or beyond the maximum that can be stored). The password is never hashed/updated in that case; session expiry for the user also does not run.

Source

Thrown at dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/UsersServiceImpl.java:373

        }

        if (StringUtils.isNotEmpty(userName)) {

            if (!CheckUtils.checkUserName(userName)) {
                throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, userName);
            }

            // todo: use the db unique index
            User tempUser = userDao.queryByUserNameAccurately(userName);
            if (tempUser != null && !userId.equals(tempUser.getId())) {
                throw new ServiceException(Status.USER_NAME_EXIST);
            }
            user.setUserName(userName);
        }

        if (StringUtils.isNotEmpty(userPassword)) {
            if (!CheckUtils.checkPasswordLength(userPassword)) {
                throw new ServiceException(Status.USER_PASSWORD_LENGTH_ERROR);
            }
            user.setUserPassword(EncryptionUtils.getMd5(userPassword));
            sessionService.expireSession(user.getId());
        }

        if (StringUtils.isNotEmpty(email)) {
            if (!CheckUtils.checkEmail(email)) {
                throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, email);
            }
            user.setEmail(email);
        }

        if (StringUtils.isNotEmpty(phone) && !CheckUtils.checkPhone(phone)) {
            throw new ServiceException(Status.REQUEST_PARAMS_NOT_VALID_ERROR, phone);
        }

        if (state == 0 && user.getState() != state && Objects.equals(loginUser.getId(), user.getId())) {
            throw new ServiceException(Status.NOT_ALLOW_TO_DISABLE_OWN_ACCOUNT);

View on GitHub (pinned to 02eac45a1b)

Solutions

1. Generate a password within the enforced length bounds (use a strong value well above the minimum)
2. Check CheckUtils.checkPasswordLength in your version for the exact min/max
3. Add client-side length validation before calling the API
4. Update provisioning templates that set short bootstrap passwords

Example fix

// before
String pwd = "ab"; // too short
usersService.updateUser(loginUser, userId, null, pwd, ...);
// after
String pwd = PasswordGenerator.random(12); // within policy
if (pwd.length() < 6 || pwd.length() > 40) throw new IllegalArgumentException("password length invalid");
usersService.updateUser(loginUser, userId, null, pwd, ...);

// mirror CheckUtils.checkPasswordLength before calling
if (userPassword != null && (userPassword.length() < 6 || userPassword.length() > 40)) {
    throw new IllegalArgumentException("password length must be within policy");
}

boolean isValidPassword(String pwd) {
    return pwd != null && pwd.length() >= 6 && pwd.length() <= 40; // align with checkPasswordLength
}

try {
    usersService.updateUser(loginUser, userId, name, userPassword, ...);
} catch (ServiceException e) {
    if (e.getCode() == Status.USER_PASSWORD_LENGTH_ERROR.getCode()) {
        // regenerate a compliant password and retry
    } else { throw e; }
}

When it happens

Trigger: PUT /users with a password shorter than the minimum (per default policy, out of the 2..~40 range enforced by checkPasswordLength); scripts setting empty or 1-char passwords; password manager output exceeding the max length.

Common situations: Automated provisioning generating weak default passwords; UI allowing unlimited input but backend rejecting; policy changes across DolphinScheduler versions making previously valid passwords too short.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• 10017
• DESCRIPTION_TOO_LONG_ERROR
• ENVIRONMENT_NAME_IS_NULL
• REQUEST_PARAMS_NOT_VALID_ERROR
• 10010

AI-assisted analysis of apache/dolphinscheduler@02eac45a1b (2026-09-06). Data as JSON: /api/errors/51ea1dcab83d79dd. Report an issue: GitHub.