apereo/cas · error · FailedLoginException

Account password on record for

Error message

Account password on record for [{}] does not match the given/encoded password

What it means

AmazonCloudDirectoryAuthenticationHandler logs this warning when the password stored in the Cloud Directory user attributes does not match the presented password per matches(originalPassword, userPassword). It throws FailedLoginException: the account was found but credentials are invalid.

Solutions

Confirm the submitted password is correct for the account.
Set cas.authn.password-encoder.type to the algorithm matching stored hashes (e.g. BCRYPT, SSHA).
Re-provision/correct the stored password attribute if it was seeded incorrectly.
Inspect the raw stored attribute value for unexpected prefixes, salts, or whitespace.

Example fix

// before
cas.authn.password-encoder.type=DEFAULT
// after
cas.authn.password-encoder.type=BCRYPT
cas.authn.password-encoder.encoding=UTF-8

Defensive patterns

Strategy: try-catch

Validate before calling

// verify encoder compatibility with stored hash format
if (!storedPassword.matches(passwordEncoder.getPattern())) {
  throw new IllegalStateException("stored password format not supported by encoder");
}

Try / catch

try {
  return cloudDirectoryHandler.authenticate(credential);
} catch (FailedLoginException e) {
  LOGGER.warn("Bad password for [{}] against Cloud Directory", credential.getUsername());
  return AuthenticationHandlerResult.badPassword(credential);
}

Prevention

Match cas.authn.password-encoder.type to the hashing scheme used when writing passwords to Cloud Directory.
Test with a known-good credential pair after any encoder or storage change.
Normalize stored values (no stray whitespace/prefixes) when provisioning users.
Log the encoder type alongside failures to speed diagnosis of mismatch issues.

When it happens

Trigger: authenticateUsernamePasswordInternal reads the configured password attribute and matches() (via the handler's password comparison/encoder) returns false.

Common situations: Wrong password entered; stored password hashed with a scheme the configured password encoder does not expect; attribute contains salt-prefix formats incompatible with the encoder; password updated in Cloud Directory but cached/replicated values stale.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/f395641d087f2368. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java:53

    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,
                                                                                        @Nullable final String originalPassword) throws Throwable {

        val username = credential.getUsername();

        val attributes = repository.getUser(username);

        if (attributes == null || attributes.isEmpty()
            || !attributes.containsKey(cloudDirectoryProperties.getUsernameAttributeName())
            || !attributes.containsKey(cloudDirectoryProperties.getPasswordAttributeName())) {
            LOGGER.warn("Unable to find account [{}]: The account does not exist or it's missing username/password attributes", username);
            throw new AccountNotFoundException();
        }

        LOGGER.debug("Located account attributes [{}] for [{}]", attributes.keySet(), username);

        val userPassword = attributes.get(cloudDirectoryProperties.getPasswordAttributeName()).getFirst().toString();
        if (!matches(Objects.requireNonNull(originalPassword), userPassword)) {
            LOGGER.warn("Account password on record for [{}] does not match the given/encoded password", username);
            throw new FailedLoginException();
        }
        val principal = this.principalFactory.createPrincipal(username, attributes);
        return createHandlerResult(credential, principal, new ArrayList<>());
    }
}

View on GitHub (pinned to e7288fc434)