{"record":{"id":"5fa1f7338322d88e","repo":"theonedev/onedev","slug":"incorrect-credentials","errorCode":null,"errorMessage":"Incorrect credentials","messagePattern":"Incorrect credentials","errorType":"validation","errorClass":"IncorrectCredentialsException","httpStatus":null,"severity":"warning","filePath":"server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java","lineNumber":282,"sourceCode":"                \t\tStringUtils.substringAfter(searchResult.getName(), \"//\"), \"/\"));\n                \n                ldapEnv.put(Context.PROVIDER_URL, builder.toString());\n                logger.debug(\"Binding to referral ldap url '\" + builder.toString() + \"'...\");\n                referralCtx = new InitialDirContext(ldapEnv);\n            }\n            if (userDN.startsWith(\"ldap\")) {\n            \tuserDN = StringUtils.substringAfter(userDN, \"//\");\n            \tuserDN = StringUtils.substringAfter(userDN, \"/\");\n            }\n\n            ldapEnv.put(Context.SECURITY_PRINCIPAL, userDN);\n            ldapEnv.put(Context.SECURITY_CREDENTIALS, new String(token.getPassword()));\n            DirContext userCtx = null;\n            try {\n                userCtx = new InitialDirContext(ldapEnv);\n            } catch (AuthenticationException e) {\n                logger.error(\"Unable to bind as '\" + userDN + \"'\", e);\n            \tthrow new IncorrectCredentialsException(\"Incorrect credentials\");\n            } finally {\n                if (userCtx != null) {\n                    try {\n                        userCtx.close();\n                    } catch (NamingException e) {\n                    }\n                }\n            }\n            \n            DirContext effectiveCtxt = referralCtx != null? referralCtx: ctx;\n            Attributes searchResultAttributes = searchResult.getAttributes();\n            if (searchResultAttributes != null) {\n                if (getUserFullNameAttribute() != null) {\n                    Attribute attribute = searchResultAttributes.get(getUserFullNameAttribute());\n                    if (attribute != null && attribute.get() != null)\n                        fullName = (String) attribute.get();\n                }\n                ","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java#L264-L300","documentation":"After locating the user's DN, OneDev attempts an LDAP 'simple' bind as that DN using the supplied password. If the server rejects the bind with AuthenticationException, the credentials are wrong and OneDev throws IncorrectCredentialsException('Incorrect credentials').","triggerScenarios":"new InitialDirContext(ldapEnv) with SECURITY_PRINCIPAL=userDN and SECURITY_CREDENTIALS=entered password throws javax.naming.AuthenticationException — the password typed at login does not match the directory password for the resolved userDN.","commonSituations":"User mistyped or caps-locked the password; account locked/expired or must change password at next logon in AD; password stored with leading/trailing whitespace; directory replication lag after a recent password change.","solutions":["Re-enter the password carefully (check caps lock and keyboard layout).","Test the password directly with ldapwhoami -H ldaps://host -D 'userDN' -W to confirm it is a OneDev-independent problem.","Check the account status in the directory: unlocked, not expired, no 'must change password' flag.","If recently changed, retry after directory replication completes."],"exampleFix":"// no code fix; server-side check:\n// ldapwhoami -H ldaps://ldap.example.com -D 'cn=Jane Doe,ou=People,dc=example,dc=com' -W\n// before: password \"secret \" (trailing space) -> after: \"secret\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    userCtx = new InitialDirContext(ldapEnv);\n} catch (AuthenticationException e) {\n    // prompt user to re-enter password; check AD account lock/expiry before retry\n} catch (NamingException e) {\n    // connectivity/server problem, distinguishable from bad credentials\n}","preventionTips":["Avoid trimming/transforming passwords entered by users","Monitor AD for account lockout policies triggered by retries","Keep bind attempts rate-limited to avoid lockouts","Test user binds with ldapwhoami independently of OneDev"],"tags":["ldap","authentication","bad-credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}