{"record":{"id":"3e00212aba1207d3","repo":"prestodb/presto","slug":"invalid-credentials-3e0021","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"http","errorClass":"AccessDeniedException","httpStatus":401,"severity":"warning","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java","lineNumber":115,"sourceCode":"    private Principal authenticate(Credentials credentials)\n    {\n        return authenticate(credentials.getUser(), credentials.getPassword());\n    }\n\n    private Principal authenticate(String user, String password)\n    {\n        Map<String, String> environment = createEnvironment(user, password);\n        DirContext context = null;\n        try {\n            context = createDirContext(environment);\n            checkForGroupMembership(user, context);\n\n            log.debug(\"Authentication successful for user [%s]\", user);\n            return new BasicPrincipal(user);\n        }\n        catch (AuthenticationException e) {\n            log.debug(\"Authentication failed for user [%s]: %s\", user, e.getMessage());\n            throw new AccessDeniedException(\"Invalid credentials\");\n        }\n        catch (NamingException e) {\n            log.debug(e, \"Authentication error for user [%s]\", user);\n            throw new RuntimeException(\"Authentication error\");\n        }\n        finally {\n            if (context != null) {\n                closeContext(context);\n            }\n        }\n    }\n\n    private Map<String, String> createEnvironment(String user, String password)\n    {\n        return ImmutableMap.<String, String>builder()\n                .putAll(basicEnvironment)\n                .put(SECURITY_AUTHENTICATION, \"simple\")\n                .put(SECURITY_PRINCIPAL, createPrincipal(user))","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/ldap/LdapAuthenticator.java#L97-L133","documentation":"LdapAuthenticator.authenticate catches javax.naming.AuthenticationException from the LDAP bind and rethrows it as AccessDeniedException(\"Invalid credentials\"). This means the LDAP server explicitly rejected the bind for the supplied user DN/password: a genuine authentication rejection by the directory, surfaced to the client as invalid credentials.","triggerScenarios":"A client authenticates; the authenticator binds to the LDAP server as the DN built from the user-bind-pattern with the given password; the server returns AuthenticationException (LDAP code 49, invalid credentials).","commonSituations":"Wrong password on the client; user DN template mismatch so the bind DN is wrong; user missing, disabled, or locked in LDAP; expired password; wrong base DN or replica; special characters in the username breaking DN construction.","solutions":["Verify the client's password by binding manually (ldapwhoami -x -H ldaps://... -D <userDn> -W)","Check the user-bind-pattern produces the correct DN; test the exact DN with ldapsearch","Confirm the user account is active (not locked/expired) and under the expected base DN","Enable debug logging to see the user DN used and the server's rejection reason"],"exampleFix":"// before\npresto.ldap.user-bind-pattern=${USER}@example.com  // wrong form for this directory\n// after\npresto.ldap.user-bind-pattern=uid=${USER},ou=people,dc=example,dc=com","handlingStrategy":"try-catch","validationCode":"// Verify the bind works before pointing the coordinator at it:\n// ldapwhoami -x -H ldaps://ldap.example.com:636 -D 'uid=alice,ou=people,dc=example,dc=com' -W","typeGuard":null,"tryCatchPattern":"try {\n    return ldapAuthenticator.authenticate(user, password);\n} catch (AccessDeniedException e) {\n    auditLog.warn(\"LDAP bind rejected for user {}\", user);\n    throw new WebApplicationException(Status.UNAUTHORIZED);\n}","preventionTips":["Test the exact DN from the user-bind-pattern with ldapwhoami before deploying config changes","Keep client LDAP passwords in sync via the same secrets pipeline as the directory","Monitor user account lockout/expiry in the directory","Escape/sanitize usernames used in DN construction"],"tags":["ldap","authentication","bind","access-denied"],"backgroundTag":"ldap-bind-failed","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}