{"record":{"id":"1bd6f34a3f131675","repo":"n8n-io/n8n","slug":"401-1bd6f3","errorCode":"401","errorMessage":"Reset your password to gain access to the instance.","messagePattern":"Reset your password to gain access to the instance\\.","errorType":"http","errorClass":"AuthError","httpStatus":401,"severity":"error","filePath":"packages/cli/src/auth/handlers/email.auth-handler.ts","lineNumber":39,"sourceCode":"\t) {}\n\n\tasync handleLogin(email: string, password: string): Promise<User | undefined> {\n\t\tconst user = await this.userRepository.findOne({\n\t\t\twhere: { email },\n\t\t\trelations: ['authIdentities', 'role'],\n\t\t});\n\n\t\tif (user?.password && (await this.passwordUtility.compare(password, user.password))) {\n\t\t\treturn user;\n\t\t}\n\n\t\t// At this point if the user has a LDAP ID, means it was previously an LDAP user,\n\t\t// so suggest to reset the password to gain access to the instance.\n\t\tconst ldapIdentity = user?.authIdentities?.find((i) => i.providerType === 'ldap');\n\t\tif (user && ldapIdentity && !this.globalConfig.sso.ldap.loginEnabled) {\n\t\t\tthis.eventService.emit('login-failed-due-to-ldap-disabled', { userId: user.id });\n\n\t\t\tthrow new AuthError('Reset your password to gain access to the instance.');\n\t\t}\n\n\t\treturn undefined;\n\t}\n}\n","sourceCodeStart":21,"sourceCodeEnd":45,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/auth/handlers/email.auth-handler.ts#L21-L45","documentation":"Email auth handler throws AuthError('Reset your password to gain access to the instance.') (401) when a user's password did not match, but the account has an LDAP authIdentity AND LDAP login is currently disabled. This guides the former-LDAP user to reset their password since LDAP is off.","triggerScenarios":"Email/password login where bcrypt compare failed, the user has a providerType==='ldap' authIdentity, and globalConfig.sso.ldap.loginEnabled is false. Emits 'login-failed-due-to-ldap-disabled' telemetry before throwing.","commonSituations":"LDAP integration was disabled but former LDAP users never set a local password; user is typing their LDAP password against the local login form after SSO was turned off.","solutions":["Use the password reset flow to establish a local password, then log in.","If LDAP should still work, re-enable it (N8N_SSO_LDAP_LOGIN_ENABLED=true) and configure the LDAP server.","Admin can clear the LDAP authIdentity for the user if they should be a pure local user."],"exampleFix":"n/a","handlingStrategy":"try-catch","validationCode":"n/a (authIdentity presence and LDAP flag are server-side)","typeGuard":"function isLdapResetPrompt(error: unknown): boolean {\n  return error instanceof Error && error.message.startsWith('Reset your password');\n}","tryCatchPattern":"try {\n  const user = await emailAuthHandler.authenticate(email, password);\n} catch (e) {\n  if (isLdapResetPrompt(e)) { /* show 'reset password' flow */ }\n  else throw e;\n}","preventionTips":["When disabling LDAP, run a password-reset campaign for former LDAP users.","Clear LDAP authIdentities for users who should be local-only.","Keep LDAP enabled if the directory should remain the source of truth."],"tags":["auth","ldap","sso","password-reset","http-401"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}