{"record":{"id":"29a3072a2a2f8b77","repo":"apereo/cas","slug":"invalid-credentials-29a307","errorCode":null,"errorMessage":"Invalid credentials: ","messagePattern":"Invalid credentials: ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-okta-authentication/src/main/java/org/apereo/cas/okta/OktaAuthenticationHandler.java","lineNumber":53,"sourceCode":"    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        final String originalPassword)\n        throws GeneralSecurityException {\n\n        try {\n            val username = credential.getUsername();\n            val adapter = new OktaAuthenticationStateHandlerAdapter(getPasswordPolicyHandlingStrategy(), getPasswordPolicyConfiguration());\n            val response = oktaAuthenticationClient.authenticate(username, credential.getPassword(), null, adapter);\n            Objects.requireNonNull(response, \"Authentication response cannot be null\");\n            adapter.throwExceptionIfNecessary();\n            LOGGER.debug(\"Created principal for id [{}] and [{}] attributes\", adapter.getUsername(), adapter.getUserAttributes());\n            val principal = this.principalFactory.createPrincipal(adapter.getUsername(), adapter.getUserAttributes());\n            return createHandlerResult(credential, principal, adapter.getWarnings());\n        } catch (final Throwable e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new FailedLoginException(\"Invalid credentials: \" + e.getMessage());\n        }\n    }\n\n}\n","sourceCodeStart":35,"sourceCodeEnd":58,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-okta-authentication/src/main/java/org/apereo/cas/okta/OktaAuthenticationHandler.java#L35-L58","documentation":"OktaAuthenticationHandler.authenticateUsernamePasswordInternal catches any Throwable from the Okta authentication adapter (after throwExceptionIfNecessary), logs it, and converts it to FailedLoginException(\"Invalid credentials: \" + message). It maps all Okta client errors into a credential failure.","triggerScenarios":"Username/password authentication against Okta fails at any stage — invalid credentials, disabled/locked user, Okta API errors (bad org URL, invalid API token, network failure, rate limit) — any underlying exception is wrapped as invalid credentials.","commonSituations":"Wrong Okta domain or API token configured in cas.authn.okta; user typed wrong password; Okta service outage or unreachable from CAS; Okta SDK throwing on malformed responses.","solutions":["Verify the actual cause in the CAS logs (LoggingUtils prints the original exception) and fix that root issue","Check cas.authn.okta[0].domain and api-token configuration; test connectivity to the Okta tenant","Confirm the user account exists and is active/unlocked in Okta"],"exampleFix":"// before\ncas.authn.okta[0].domain=https://wrong-org.okta.com\ncas.authn.okta[0].api-token=staleToken\n// after\ncas.authn.okta[0].domain=https://example.okta.com\ncas.authn.okta[0].api-token=${OKTA_API_TOKEN}","handlingStrategy":"try-catch","validationCode":"// preflight: verify Okta reachability and token validity\nboolean ok = oktaHealthCheck(domain, apiToken);","typeGuard":null,"tryCatchPattern":"try { handlerResult = oktaHandler.authenticate(cred); }\ncatch (FailedLoginException e) { log root cause from CAS log; show generic auth failure to user; }","preventionTips":["Monitor CAS logs for the wrapped root exception","Validate Okta domain/api-token in config tests","Alert on Okta API availability"],"tags":["authentication","okta","failed-login"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}