{"record":{"id":"1d6b2ff5a2503c0d","repo":"theonedev/onedev","slug":"no-external-password-authenticator-to-authenticate","errorCode":null,"errorMessage":"No external password authenticator to authenticate user \"{0}\"","messagePattern":"No external password authenticator to authenticate user \"(.+?)\"","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java","lineNumber":169,"sourceCode":"\t\t\t\t\t\t\tif (emailAddressValue != null) {\n\t\t\t\t\t\t\t\tvar emailAddress = emailAddressService.findByValue(emailAddressValue);\n\t\t\t\t\t\t\t\tif (emailAddress != null) {\n\t\t\t\t\t\t\t\t\tif (emailAddress.getOwner().equals(user) || !emailAddress.isVerified()) {\n\t\t\t\t\t\t\t\t\t\tupdateUser(user, authenticated, emailAddress, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t\t\t\treturn user;\n\t\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"Email address \\\"{0}\\\" already used by another account\"), emailAddressValue));\n\t\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tupdateUser(user, authenticated, null, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t\t\treturn user;\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tupdateUser(user, authenticated, null, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t\treturn user;\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"No external password authenticator to authenticate user \\\"{0}\\\"\"), userName));\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\treturn user;\n\t\t\t\t\t}\n\t\t\t\t} else {\n\t\t\t\t\tvar authenticator = settingService.getAuthenticator();\n\t\t\t\t\tif (authenticator != null) {\n\t\t\t\t\t\tvar authenticated = authenticator.authenticate((UsernamePasswordToken) token);\n\t\t\t\t\t\tvar emailAddressValue = authenticated.getEmail();\n\t\t\t\t\t\tif (emailAddressValue != null) {\n\t\t\t\t\t\t\tvar emailAddress = emailAddressService.findByValue(emailAddressValue);\n\t\t\t\t\t\t\tif (emailAddress != null) {\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tif (!emailAddress.isVerified()) {\n\t\t\t\t\t\t\t\t\temailAddressService.delete(emailAddress);\n\t\t\t\t\t\t\t\t\treturn newUser(userName, authenticated, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"Email address \\\"{0}\\\" already used by another account\"), emailAddressValue));\n\t\t\t\t\t\t\t\t}","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java#L151-L187","documentation":"The local user has a null password, meaning its credentials are managed by an external password authenticator. If settingService.getAuthenticator() returns null (no external authenticator configured), OneDev cannot verify the credentials and throws this AuthenticationException instead of falling back to local password checks.","triggerScenarios":"Password login for a user whose User.getPassword() is null while no external authenticator is configured in Administration -> Authenticators (or the authenticator setting failed to load).","commonSituations":"Server was migrated/restored from a backup that had an external authenticator (LDAP, SSO) configured, but the new instance lacks the authenticator config; or users were imported with null passwords from an external source.","solutions":["Configure the external password authenticator under Server Administration -> Authenticators matching the original setup.","If external auth is no longer wanted, set a local password for the user(s) so getPassword() != null.","Check server logs/config for authenticator settings that failed to load after migration.","As a stopgap, an admin can reset the user's password to create a local credential."],"exampleFix":"// before: user imported with null password, no authenticator configured -> error\n// after (admin): Administration -> Authenticators -> add LDAP authenticator,\n// or set the user's password locally so login uses internal password check","handlingStrategy":"validation","validationCode":"// Check authenticator presence before password login of externally-managed users:\nif (settingService.getAuthenticator() == null && user.getPassword() == null) {\n  configureExternalAuthenticatorOrSetLocalPassword();\n}","typeGuard":"function canUsePasswordAuth(user, settings) { return user.password != null || settings.authenticator != null; }","tryCatchPattern":"try {\n  authenticate(userName, password);\n} catch (AuthenticationException e) {\n  if (e.getMessage().contains(\"No external password authenticator\")) {\n    alertAdmin(\"Configure external authenticator in Administration -> Authenticators\");\n  }\n}","preventionTips":["Back up and restore authenticator settings together with the rest of server config.","After migration, smoke-test login for an externally-managed user.","Avoid importing users with null passwords unless an external authenticator will be configured."],"tags":["authentication","configuration","ldap"],"backgroundTag":"missing-configuration","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}