apereo/cas · error · FailedLoginException

Invalid credentials:

Error message

Invalid credentials: 

What it means

OktaAuthenticationHandler.authenticateUsernamePasswordInternal catches any Throwable from the Okta authentication adapter (after throwExceptionIfNecessary), logs it, and converts it to FailedLoginException("Invalid credentials: " + message). It maps all Okta client errors into a credential failure.

Solutions

1. Verify the actual cause in the CAS logs (LoggingUtils prints the original exception) and fix that root issue
2. Check cas.authn.okta[0].domain and api-token configuration; test connectivity to the Okta tenant
3. Confirm the user account exists and is active/unlocked in Okta

Example fix

// before
cas.authn.okta[0].domain=https://wrong-org.okta.com
cas.authn.okta[0].api-token=staleToken
// after
cas.authn.okta[0].domain=https://example.okta.com
cas.authn.okta[0].api-token=${OKTA_API_TOKEN}

// preflight: verify Okta reachability and token validity
boolean ok = oktaHealthCheck(domain, apiToken);

try { handlerResult = oktaHandler.authenticate(cred); }
catch (FailedLoginException e) { log root cause from CAS log; show generic auth failure to user; }

When it happens

Trigger: Username/password authentication against Okta fails at any stage — invalid credentials, disabled/locked user, Okta API errors (bad org URL, invalid API token, network failure, rate limit) — any underlying exception is wrapped as invalid credentials.

Common situations: Wrong Okta domain or API token configured in cas.authn.okta; user typed wrong password; Okta service outage or unreachable from CAS; Okta SDK throwing on malformed responses.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials:
• Unable to accept cookie for authentication
• Cannot validate authentication for: [login]
• Could not authenticate account for
• Account password on file does not match the provided…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/29a3072a2a2f8b77. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-okta-authentication/src/main/java/org/apereo/cas/okta/OktaAuthenticationHandler.java:53

    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,
                                                                                        final String originalPassword)
        throws GeneralSecurityException {

        try {
            val username = credential.getUsername();
            val adapter = new OktaAuthenticationStateHandlerAdapter(getPasswordPolicyHandlingStrategy(), getPasswordPolicyConfiguration());
            val response = oktaAuthenticationClient.authenticate(username, credential.getPassword(), null, adapter);
            Objects.requireNonNull(response, "Authentication response cannot be null");
            adapter.throwExceptionIfNecessary();
            LOGGER.debug("Created principal for id [{}] and [{}] attributes", adapter.getUsername(), adapter.getUserAttributes());
            val principal = this.principalFactory.createPrincipal(adapter.getUsername(), adapter.getUserAttributes());
            return createHandlerResult(credential, principal, adapter.getWarnings());
        } catch (final Throwable e) {
            LoggingUtils.error(LOGGER, e);
            throw new FailedLoginException("Invalid credentials: " + e.getMessage());
        }
    }

}

View on GitHub (pinned to e7288fc434)