{"record":{"id":"6800c824fd6367dd","repo":"theonedev/onedev","slug":"invalid-credentials","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"exception","errorClass":"UnknownAccountException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java","lineNumber":195,"sourceCode":"\t\t\t\t\t\tvar authenticated = authenticator.authenticate((UsernamePasswordToken) token);\n\t\t\t\t\t\tvar emailAddressValue = authenticated.getEmail();\n\t\t\t\t\t\tif (emailAddressValue != null) {\n\t\t\t\t\t\t\tvar emailAddress = emailAddressService.findByValue(emailAddressValue);\n\t\t\t\t\t\t\tif (emailAddress != null) {\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\tif (!emailAddress.isVerified()) {\n\t\t\t\t\t\t\t\t\temailAddressService.delete(emailAddress);\n\t\t\t\t\t\t\t\t\treturn newUser(userName, authenticated, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\t\tthrow new AuthenticationException(MessageFormat.format(_T(\"Email address \\\"{0}\\\" already used by another account\"), emailAddressValue));\n\t\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\treturn newUser(userName, authenticated, authenticator.getDefaultGroup());\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\treturn newUser(userName, authenticated, authenticator.getDefaultGroup());\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new UnknownAccountException(_T(\"Invalid credentials\"));\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (Exception e) {\n\t\t\t\tif (e instanceof AuthenticationException) {\n\t\t\t\t\tlogger.debug(\"Authentication not passed\", e);\n\t\t\t\t\tthrow ExceptionUtils.unchecked(e);\n\t\t\t\t} else {\n\t\t\t\t\tlogger.error(\"Error authenticating user\", e);\n\t\t\t\t\tthrow new AuthenticationException(_T(\"Error authenticating user\"), e);\n\t\t\t\t}\n\t\t\t}\n\t\t});\n\t}\n\n\tpublic Object writeReplace() throws ObjectStreamException {\n\t\treturn new ManagedSerializedForm(AuthenticatingService.class);\n\t}\n","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java#L177-L213","documentation":"When neither an email-matched nor name-matched user exists and no external authenticator can claim the identity, OneDev has no way to authenticate the principal and throws UnknownAccountException('Invalid credentials'). Despite the message wording, it means the supplied user name/email does not map to any locally known account with usable credentials.","triggerScenarios":"Username/password login where userService.findByVerifiedEmailAddress and findByName both return null and settingService.getAuthenticator() is null (no external authenticator to create the user).","commonSituations":"Typo in the username; login with an email that is not registered; SSO/LDAP users attempting password login before the external authenticator is configured; account removed from OneDev while client credentials persist.","solutions":["Verify the username/email is correct and the account exists in Administration -> Users.","If the user should exist, create the account or configure the external password authenticator so unknown identities can be provisioned.","For external-auth deployments, log in via the SSO/LDAP flow instead of assuming local password auth.","Check that you are using the right login field (username vs verified email)."],"exampleFix":"// before\ncurl -u jdoe:pass https://onedev.example.com/api/projects  # user 'jdoe' does not exist\n// after (admin creates user 'jdoe' or configures LDAP authenticator)\ncurl -u jdoe:pass https://onedev.example.com/api/projects","handlingStrategy":"validation","validationCode":"const user = await findUserByNameOrVerifiedEmail(identifier);\nif (user == null && authenticator == null) {\n  throw new Error('Unknown account: create the user or configure an external authenticator first');\n}","typeGuard":"function isKnownPrincipal(idOrEmail, userService) {\n  return userService.findByName(idOrEmail) != null || userService.findByVerifiedEmailAddress(idOrEmail) != null;\n}","tryCatchPattern":"try {\n  authenticate(principal, password);\n} catch (UnknownAccountException e) {\n  logger.warn(\"No local account for principal; check username or admin setup\");\n}","preventionTips":["Provision users (or configure the external authenticator) before distributing credentials.","Standardize on usernames in automation to avoid email/name ambiguity.","Confirm account existence after restores or user deletions."],"tags":["authentication","credentials","unknown-account"],"backgroundTag":"invalid-credentials","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}