{"record":{"id":"757ca13eda37cab6","repo":"flowable/flowable-engine","slug":"authentication-failed-for-this-username-and-passwo-757ca1","errorCode":null,"errorMessage":"Authentication failed for this username and password","messagePattern":"Authentication failed for this username and password","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"modules/flowable-rest/src/main/java/org/flowable/rest/security/BasicAuthenticationProvider.java","lineNumber":65,"sourceCode":"        String password = authentication.getCredentials().toString();\n\n        boolean authenticated = idmIdentityService.checkPassword(userId, password);\n        if (authenticated) {\n            \n            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>(1);\n            if (isVerifyRestApiPrivilege()) {\n                List<Privilege> privileges = idmIdentityService.createPrivilegeQuery().userId(userId).list();\n                for (Privilege privilege : privileges) {\n                    grantedAuthorities.add(new SimpleGrantedAuthority(privilege.getName()));\n                }\n            } else {\n                // Always add the role when it's not verified: this makes the config easier (i.e. user needs to have it)\n                grantedAuthorities.add(new SimpleGrantedAuthority(SecurityConstants.PRIVILEGE_ACCESS_REST_API));\n            }\n            \n            return new UsernamePasswordAuthenticationToken(userId, password, grantedAuthorities);\n        } else {\n            throw new BadCredentialsException(\"Authentication failed for this username and password\");\n        }\n    }\n\n    @Override\n    public boolean supports(Class<?> authentication) {\n        return authentication.equals(UsernamePasswordAuthenticationToken.class);\n    }\n\n    public boolean isVerifyRestApiPrivilege() {\n        return verifyRestApiPrivilege;\n    }\n\n    public void setVerifyRestApiPrivilege(boolean verifyRestApiPrivilege) {\n        this.verifyRestApiPrivilege = verifyRestApiPrivilege;\n    }\n    \n}\n","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-rest/src/main/java/org/flowable/rest/security/BasicAuthenticationProvider.java#L47-L83","documentation":"BasicAuthenticationProvider authenticates REST API requests using username/password from HTTP Basic auth against the Flowable identity service. When the authentication manager cannot validate the presented credentials, it throws BadCredentialsException with this generic message, deliberately not revealing whether the username or password was wrong.","triggerScenarios":"Any REST call with an Authorization: Basic header whose decoded username/password combination fails authentication — unknown user, wrong password, or disabled user in the identity store.","commonSituations":"Stale or mistyped credentials in REST client config, users authenticated against an external directory not wired into the Flowable authentication provider, password changed/expired, or Basic auth header missing/garbled so the resolver yields wrong values.","solutions":["Verify the username and password by querying the identity store or logging in via the UI.","Check the configured AuthenticationProvider chain — if using LDAP, ensure ldapAuthenticationProvider is registered and reachable.","Confirm the client is sending a correct Base64-encoded Basic auth header for the right realm/engine.","Reset the user's password via identityService.setUserPassword or your user management UI."],"exampleFix":"// before\ncurl -u admin:wronpass http://localhost:8080/flowable-rest/service/repository/process-definitions\n// after\ncurl -u admin:test http://localhost:8080/flowable-rest/service/repository/process-definitions","handlingStrategy":"try-catch","validationCode":"long count = identityService.createUserQuery().userId(username).count();\nif (count == 0) { throw new IllegalStateException(\"Unknown REST user\"); }","typeGuard":null,"tryCatchPattern":"try { restCall(); } catch (BadCredentialsException e) { // re-prompt or refresh credentials before retrying\n}","preventionTips":["Keep REST client credentials in sync with the identity store","Verify the AuthenticationProvider chain (LDAP/JDBC) matches your user source","Never log or hardcode credentials; rotate after changes"],"tags":["flowable","rest","security","authentication"],"backgroundTag":"authentication-required","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}