{"record":{"id":"57d5e3e917901fd4","repo":"apereo/cas","slug":"account-password-on-record-for-does-not-match-57d5e3","errorCode":null,"errorMessage":"Account password on record for [{}] does not match the given/encoded password","messagePattern":"Account password on record for \\[(.+?)\\] does not match the given/encoded password","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-redis-authentication/src/main/java/org/apereo/cas/redis/RedisAuthenticationHandler.java","lineNumber":40,"sourceCode":"    private final CasRedisTemplate redisTemplate;\n\n    public RedisAuthenticationHandler(final String name,\n                                      final PrincipalFactory principalFactory, final Integer order,\n                                      final CasRedisTemplate redisTemplate) {\n        super(name, principalFactory, order);\n        this.redisTemplate = redisTemplate;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential credential,\n        final String originalPassword) throws Throwable {\n        val account = (RedisUserAccount) redisTemplate.opsForValue().get(credential.getUsername());\n        if (account == null) {\n            throw new AccountNotFoundException();\n        }\n        if (!getPasswordEncoder().matches(originalPassword, account.getPassword())) {\n            LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", credential.getId());\n            throw new FailedLoginException();\n        }\n        switch (account.getStatus()) {\n            case DISABLED -> throw new AccountDisabledException();\n            case EXPIRED -> throw new AccountExpiredException();\n            case LOCKED -> throw new AccountLockedException();\n            case MUST_CHANGE_PASSWORD -> throw new AccountPasswordMustChangeException();\n            case OK -> LOGGER.debug(\"Account status is OK\");\n        }\n        val principal = principalFactory.createPrincipal(account.getUsername(), account.getAttributes());\n        return createHandlerResult(credential, principal, new ArrayList<>());\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-redis-authentication/src/main/java/org/apereo/cas/redis/RedisAuthenticationHandler.java#L22-L54","documentation":"RedisAuthenticationHandler fetches the RedisUserAccount by username and compares the submitted password via the configured password encoder. When the encoder's matches() fails, it logs this warning and throws FailedLoginException — the credentials presented do not match the stored (encoded) password.","triggerScenarios":"authenticateUsernamePasswordInternal receives a UsernamePasswordCredential whose raw password does not match account.getPassword() under the configured PasswordEncoder (e.g. BCrypt hash mismatch).","commonSituations":"Account records written with a different encoding algorithm than the handler's configured encoder; user typo/caps-lock; stale Redis data after a password change elsewhere; encoder misconfiguration (plain vs bcrypt).","solutions":["Verify the user's password is correct; test with the known-good credentials for the Redis-backed account.","Ensure the stored account.getPassword() value was encoded with the same algorithm as cas.authn.passwordEncoder (or the handler's encoder bean).","Re-import/update the account record in Redis with the correct hash for the current encoder.","Check for whitespace/encoding issues (trailing newline) in the credential or stored value."],"exampleFix":"// before — stored plaintext but encoder is BCrypt\nredisTemplate.opsForValue().set(\"alice\", new RedisUserAccount(\"alice\", \"plainpw\", Status.OK));\n// after — store the encoded form\nredisTemplate.opsForValue().set(\"alice\", new RedisUserAccount(\"alice\", new BCryptPasswordEncoder().encode(\"correctpw\"), Status.OK));","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  authHandler.authenticate(credential);\n} catch (FailedLoginException | AccountNotFoundException e) {\n  // surface 'invalid credentials' to the user; do not retry automatically\n}","preventionTips":["Write Redis accounts using the same PasswordEncoder CAS is configured with","Never store plaintext passwords in Redis","Version/namespace Redis keys when changing encoding schemes and re-import users","Trim credentials and stored values of stray whitespace"],"tags":["redis","authentication","password-mismatch"],"backgroundTag":"authentication-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}