{"record":{"id":"0d664f67c60ff1a7","repo":"spring-projects/spring-security","slug":"bad-credentials-0d664f","errorCode":null,"errorMessage":"Bad credentials","messagePattern":"Bad credentials","errorType":"exception","errorClass":"InternalAuthenticationServiceException","httpStatus":null,"severity":"error","filePath":"ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java","lineNumber":183,"sourceCode":"\tpublic ActiveDirectoryLdapAuthenticationProvider(String domain, String url) {\n\t\tAssert.isTrue(StringUtils.hasText(url), \"Url cannot be empty\");\n\t\tthis.domain = StringUtils.hasText(domain) ? domain.toLowerCase(Locale.ROOT) : null;\n\t\tthis.url = url;\n\t\tthis.rootDn = (this.domain != null) ? rootDnFromDomain(this.domain) : null;\n\t}\n\n\t@Override\n\tprotected DirContextOperations doAuthentication(UsernamePasswordAuthenticationToken auth) {\n\t\tString username = auth.getName();\n\t\tString password = (String) auth.getCredentials();\n\t\tAssert.notNull(password, \"password cannot be null\");\n\t\tDirContext ctx = null;\n\t\ttry {\n\t\t\tctx = bindAsUser(username, password);\n\t\t\treturn searchForUser(ctx, username);\n\t\t}\n\t\tcatch (CommunicationException ex) {\n\t\t\tthrow badLdapConnection(ex);\n\t\t}\n\t\tcatch (NamingException ex) {\n\t\t\tthis.logger.error(\"Failed to locate directory entry for authenticated user: \" + username, ex);\n\t\t\tthrow badCredentials(ex);\n\t\t}\n\t\tfinally {\n\t\t\tLdapUtils.closeContext(ctx);\n\t\t}\n\t}\n\n\t/**\n\t * Creates the user authority list from the values of the {@code memberOf} attribute\n\t * obtained from the user's Active Directory entry.\n\t */\n\t@Override\n\tprotected Collection<? extends GrantedAuthority> loadUserAuthorities(DirContextOperations userData, String username,\n\t\t\tString password) {\n\t\treturn this.authoritiesPopulator.getGrantedAuthorities(userData, username);","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/ldap/src/main/java/org/springframework/security/ldap/authentication/ad/ActiveDirectoryLdapAuthenticationProvider.java#L165-L201","documentation":"ActiveDirectoryLdapAuthenticationProvider.doAuthentication() failed to search for the user after binding, because a NamingException occurred; it logs 'Failed to locate directory entry' and converts the failure to a generic BadCredentialsException with 'Bad credentials' as the message.","triggerScenarios":"bindAsUser succeeded but searchForUser threw NamingException (e.g. user DN not found under configured searchBase, search filter mismatch, directory referral issues) — the underlying cause is the wrapped NamingException.","commonSituations":"Wrong searchFilter/searchBase configuration so the authenticated user's DN is not found; user exists in a different AD domain than the search base; transient directory errors surfaced as credentials error.","solutions":["Log/inspect the cause (ex.getCause() is the NamingException) and fix the searchBase or searchFilter so the user DN is resolvable","Enable debug logging for org.springframework.security.ldap to see the failing search","Verify the user exists under the configured base and the domain matches the configured rootDn"],"exampleFix":"// before\n.ad().domain(\"corp.example.com\").userSearchFilter(\"(cn={1})\") // cn used, users keyed by sAMAccountName\n// after\n.ad().domain(\"corp.example.com\").userSearchFilter(\"(sAMAccountName={0})\")","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    authenticationManager.authenticate(adToken);\n} catch (BadCredentialsException e) {\n    Throwable cause = e.getCause(); // NamingException from searchForUser\n    logger.error(\"AD lookup failed; check searchBase/searchFilter\", cause);\n}","preventionTips":["Validate searchBase/searchFilter against the real directory (ldapsearch) before deploying","Enable DEBUG logging for org.springframework.security.ldap","Keep the cause chain intact so the underlying NamingException is inspectable","Test with users from every OU covered by the search base"],"tags":["ldap","active-directory","authentication","bad-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}