{"record":{"id":"355e51059e94f651","repo":"apereo/cas","slug":"could-not-authenticate-the-provided-credentials","errorCode":null,"errorMessage":"Could not authenticate the provided credentials","messagePattern":"Could not authenticate the provided credentials","errorType":"exception","errorClass":"CredentialsException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java","lineNumber":95,"sourceCode":"            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n\n            val clientSecret = clientIdAndSecret.getRight();\n            if (!clientSecretValidator.validate(registeredService, clientSecret)) {\n                throw new CredentialsException(\"Client Credentials provided is not valid for registered service: \"\n                    + Objects.requireNonNull(registeredService).getName());\n            }\n            val redirectUri = requestParameterResolver.resolveRequestParameter(callContext.webContext(), OAuth20Constants.REDIRECT_URI)\n                .map(String::valueOf).orElse(StringUtils.EMPTY);\n            OAuth20Utils.validateRedirectUri(redirectUri, true);\n            val service = StringUtils.isNotBlank(redirectUri)\n                ? webApplicationServiceFactory.createService(redirectUri)\n                : webApplicationServiceFactory.createService(clientId);\n            service.getAttributes().put(OAuth20Constants.CLIENT_ID, CollectionUtils.wrapList(clientId));\n            service.getAttributes().put(OAuth20Constants.REDIRECT_URI, CollectionUtils.wrapList(redirectUri));\n\n            val authenticationResult = authenticationSystemSupport.finalizeAuthenticationTransaction(service, casCredential);\n            if (authenticationResult == null) {\n                throw new CredentialsException(\"Could not authenticate the provided credentials\");\n            }\n\n            val principal = buildAuthenticatedPrincipal(authenticationResult, registeredService, service, callContext);\n            val profile = new CommonProfile();\n\n            profile.setId(principal.getId());\n            profile.addAttribute(OAuth20Constants.CLIENT_ID, clientId);\n            profile.addAttributes((Map) principal.getAttributes());\n\n            val authentication = authenticationResult.getAuthentication();\n            val authnAttributes = authenticationAttributeReleasePolicy.getAuthenticationAttributesForRelease(authentication, registeredService);\n            profile.addAuthenticationAttributes(new HashMap<>(authnAttributes));\n\n            LOGGER.debug(\"Authenticated user profile [{}]\", profile);\n            credentials.setUserProfile(profile);\n            return Optional.of(credentials);\n        } catch (final Throwable e) {\n            throw new CredentialsException(\"Cannot login user using CAS internal authentication\", e);","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java#L77-L113","documentation":"Thrown when CAS internal authentication (finalizeAuthenticationTransaction) returns null for the username/password credentials, meaning the authentication transaction could not produce an AuthenticationResult. Unlike a normal failed login (which is wrapped by the catch block), this signals the authentication pipeline itself yielded no result.","triggerScenarios":"The authenticationSystemSupport could not finalize the transaction for the given service and UsernamePasswordCredential — typically because no authentication handler accepted the credentials or the handler chain produced no authentication for the target service.","commonSituations":"User typed wrong credentials and no fallback handler exists; authentication handler for the relevant store not enabled/registered for this service; service policy excludes all applicable handlers; misconfigured authentication system at startup.","solutions":["Verify the username/password directly against the underlying authentication store (LDAP/AD/JDBC) outside CAS","Check that an authentication handler is configured and applicable to this service (handler selection/attribute-based criteria)","Inspect CAS logs at DEBUG for the authentication transaction to see why no handler produced a result","If handlers are conditionally enabled, confirm the feature/config that registers the needed handler is active"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if (!username || !password) throw new Error('username and password must be non-empty before authentication');","typeGuard":null,"tryCatchPattern":"try {\n  await casAuthenticate(creds);\n} catch (e) {\n  if (String(e.message) === 'Could not authenticate the provided credentials') {\n    // surface a user-facing 'invalid username or password' and check handler config\n  }\n}","preventionTips":["Test credentials directly against the backing store","Ensure an authentication handler is enabled for this service","Watch CAS DEBUG logs for why no handler accepted the credentials"],"tags":["oauth2","authentication","password"],"backgroundTag":"authentication-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}