{"record":{"id":"6f92092f1e5dde24","repo":"pentaho/pentaho-kettle","slug":"salesforceinput-error-invalidusernameorpassword","errorCode":"SalesforceInput.Error.InvalidUsernameOrPassword","errorMessage":"SalesforceInput.Error.InvalidUsernameOrPassword","messagePattern":"SalesforceInput\\.Error\\.InvalidUsernameOrPassword","errorType":"error_code","errorClass":"KettleException","httpStatus":null,"severity":"critical","filePath":"plugins/salesforce/core/src/main/java/org/pentaho/di/trans/steps/salesforce/SalesforceConnection.java","lineNumber":373,"sourceCode":"      this.serverTimestamp = pConnection.getServerTimestamp().getTimestamp().getTime();\n      if ( log.isDebug() ) {\n        BaseMessages.getString( PKG, \"SalesforceInput.Log.ServerTimestamp\", getServerTimestamp() );\n      }\n\n      if ( log.isDetailed() ) {\n        log.logDetailed( BaseMessages.getString( PKG, \"SalesforceInput.Log.Connected\" ) );\n      }\n\n    } catch ( LoginFault ex ) {\n      // The LoginFault derives from AxisFault\n      ExceptionCode exCode = ex.getExceptionCode();\n      if ( exCode == ExceptionCode.FUNCTIONALITY_NOT_ENABLED\n        || exCode == ExceptionCode.INVALID_CLIENT || exCode == ExceptionCode.INVALID_LOGIN\n        || exCode == ExceptionCode.LOGIN_DURING_RESTRICTED_DOMAIN\n        || exCode == ExceptionCode.LOGIN_DURING_RESTRICTED_TIME || exCode == ExceptionCode.ORG_LOCKED\n        || exCode == ExceptionCode.PASSWORD_LOCKOUT || exCode == ExceptionCode.SERVER_UNAVAILABLE\n        || exCode == ExceptionCode.TRIAL_EXPIRED || exCode == ExceptionCode.UNSUPPORTED_CLIENT ) {\n        throw new KettleException( BaseMessages.getString( PKG, \"SalesforceInput.Error.InvalidUsernameOrPassword\" ) );\n      }\n      throw new KettleException( BaseMessages.getString( PKG, \"SalesforceInput.Error.Connection\" ), ex );\n    } catch ( Exception e ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"SalesforceInput.Error.Connection\" ), e );\n    }\n  }\n\n  public void query( boolean specifyQuery ) throws KettleException {\n\n    if ( getBinding() == null ) {\n      throw new KettleException( BaseMessages.getString( PKG, \"SalesforceInput.Exception.CanNotGetBiding\" ) );\n    }\n\n    try {\n      if ( !specifyQuery ) {\n        // check if we can query this Object\n        DescribeSObjectResult describeSObjectResult = getBinding().describeSObject( getModule() );\n        if ( describeSObjectResult == null ) {","sourceCodeStart":355,"sourceCodeEnd":391,"githubUrl":"https://github.com/pentaho/pentaho-kettle/blob/f3058517a153da500bf4551f46d79b91bf8ec552/plugins/salesforce/core/src/main/java/org/pentaho/di/trans/steps/salesforce/SalesforceConnection.java#L355-L391","documentation":"connect() catches a Salesforce ConnectionException whose exception code is in the auth-failure family (INVALID_LOGIN, INVALID_CLIENT, PASSWORD_LOCKOUT, TRIAL_EXPIRED, etc.) and rethrows it as this KettleException. It means the username/password/security-token credentials were rejected by the Salesforce login endpoint.","triggerScenarios":"Calling connect() (directly or via getConnection/getFields/getModuleFields) with a wrong username, wrong password, missing/incorrect security token, expired trial, locked-out password, or a client version Salesforce no longer accepts.","commonSituations":"Password changed without updating the step; user logging in from a new IP requires adding a security token; org locked or login restricted by time/domain/IP policies; sandbox credentials used against production URL or vice versa.","solutions":["Verify the username, password, and appended security token in the Salesforce step connection settings.","If logging in from a new IP, reset/obtain the security token in Salesforce Setup (My Personal Information > Reset Security Token).","Check the exact upstream code (e.g. PASSWORD_LOCKOUT) — wait out a lockout or have an admin unlock the user.","Confirm the login URL matches the environment (test.salesforce.com vs login.salesforce.com).","Check the org's Login IP Ranges / Login Hours / restricted-domain policies with the Salesforce admin."],"exampleFix":"// before\nconn.setUsername(\"user@company.com\");\nconn.setPassword(\"p@ss\"); // token missing after password change\n// after\nconn.setUsername(\"user@company.com\");\nconn.setPassword(\"p@ssTOKEN\"); // password + current security token","handlingStrategy":"try-catch","validationCode":"if (username == null || password == null || !loginUrl.startsWith(\"https://\")) {\n  throw new IllegalArgumentException(\"Incomplete Salesforce credentials or URL\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  conn.connect();\n} catch (KettleException e) {\n  if (e.getMessage().contains(\"InvalidUsernameOrPassword\")) {\n    // treat as auth failure: refresh token/password, do not blind-retry\n    throw new AuthenticationException(e);\n  }\n  throw e;\n}","preventionTips":["Keep password + security token in sync after password changes.","Whitelist the integration host's IP in the org's Login IP Ranges.","Use a dedicated API user with login-locked retry policy.","Match login URL to environment (test vs production)."],"tags":["salesforce","authentication","credentials","api-request-failed"],"backgroundTag":"missing-credentials","analyzedSha":"f3058517a153da500bf4551f46d79b91bf8ec552","analyzedAt":"2026-09-13T14:04:16.340Z","contentChangedAt":"2026-09-13T14:04:16.340Z","schemaVersion":2},"datasetVersion":"2026-09-20T23:17:15.980Z"}