{"record":{"id":"27af3d4f73fe82b0","repo":"flowable/flowable-engine","slug":"authentication-failed-for-this-username-and-passwo","errorCode":null,"errorMessage":"Authentication failed for this username and password","messagePattern":"Authentication failed for this username and password","errorType":"http","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/security/BasicAuthenticationProvider.java","lineNumber":51,"sourceCode":"    @Autowired\n    @Lazy\n    private IdmIdentityService identityService;\n\n    @Override\n    public Authentication authenticate(Authentication authentication) throws AuthenticationException {\n        String name = authentication.getName();\n        String password = authentication.getCredentials().toString();\n\n        boolean authenticated = identityService.checkPassword(name, password);\n        if (authenticated) {\n            List<Group> groups = identityService.createGroupQuery().groupMember(name).list();\n            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();\n            for (Group group : groups) {\n                grantedAuthorities.add(new SimpleGrantedAuthority(group.getId()));\n            }\n            return new UsernamePasswordAuthenticationToken(name, password, grantedAuthorities);\n        } else {\n            throw new BadCredentialsException(\"Authentication failed for this username and password\");\n        }\n    }\n\n    @Override\n    public boolean supports(Class<?> authentication) {\n        return authentication.equals(UsernamePasswordAuthenticationToken.class);\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":60,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/security/BasicAuthenticationProvider.java#L33-L60","documentation":"This Spring Security AuthenticationProvider validated the username/password pair against the IDM identity service and the credentials did not match an existing, enabled user. It throws Spring's BadCredentialsException, which the REST layer translates into a 401 response.","triggerScenarios":"POST/basic-auth to a CMMN REST endpoint with a username that does not exist, a wrong password, or a user whose password hash does not match after an IDM/user store change.","commonSituations":"Misconfigured REST API basic-auth credentials in clients; password changed or user deactivated in the Flowable IDM tables; environment where identity data was not seeded (users/groups missing); connecting with credentials valid in a different deployment.","solutions":["Verify the username exists and is active in the Flowable IDM user tables (ACT_ID_USER)","Reset the password via the identity service/admin API and retry","Confirm the client is sending correct Basic auth header for the right environment","Check that the custom BasicAuthenticationProvider actually loads the user and compares passwords as expected (e.g. password encoder mismatch after upgrade)"],"exampleFix":"// before\ncurl -u admin:wrongpass http://host/flowable-cmmn-api/cmmn-server/repositories\n// after\ncurl -u admin:admin http://host/flowable-cmmn-api/cmmn-server/repositories","handlingStrategy":"try-catch","validationCode":"User u = identityService.createUserQuery().userId(username).singleKeyword()==null ? null : identityService.createUserQuery().userId(username).singleResult();\nif (u == null) { failFast(\"unknown user\"); }","typeGuard":null,"tryCatchPattern":"try {\n    auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(name, password));\n} catch (BadCredentialsException e) {\n    throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, \"Invalid credentials\");\n}","preventionTips":["Seed and sync IDM users (ACT_ID_USER) per environment","Keep client credentials in environment-specific config, not hardcoded","Reset passwords through the identity service when unsure","Audit custom AuthenticationProvider password encoders after upgrades"],"tags":["rest","security","authentication","bad-credentials"],"backgroundTag":"authentication-required","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}