{"record":{"id":"861d7d68ed622639","repo":"arduino/Arduino","slug":"server-rejected-request-wrong-username-or-passwor","errorCode":null,"errorMessage":"Server rejected request: wrong username or password","messagePattern":"Server rejected request: wrong username or password","errorType":"exception","errorClass":"Exception","httpStatus":401,"severity":"error","filePath":"arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/contrib/ntlmpool.py","lineNumber":103,"sourceCode":"\n        # Send authentication message\n        ServerChallenge, NegotiateFlags = \\\n            ntlm.parse_NTLM_CHALLENGE_MESSAGE(auth_header_value)\n        auth_msg = ntlm.create_NTLM_AUTHENTICATE_MESSAGE(ServerChallenge,\n                                                         self.user,\n                                                         self.domain,\n                                                         self.pw,\n                                                         NegotiateFlags)\n        headers[req_header] = 'NTLM %s' % auth_msg\n        log.debug('Request headers: %s' % headers)\n        conn.request('GET', self.authurl, None, headers)\n        res = conn.getresponse()\n        log.debug('Response status: %s %s' % (res.status, res.reason))\n        log.debug('Response headers: %s' % dict(res.getheaders()))\n        log.debug('Response data: %s [...]' % res.read()[:100])\n        if res.status != 200:\n            if res.status == 401:\n                raise Exception('Server rejected request: wrong '\n                                'username or password')\n            raise Exception('Wrong server response: %s %s' %\n                            (res.status, res.reason))\n\n        res.fp = None\n        log.debug('Connection established')\n        return conn\n\n    def urlopen(self, method, url, body=None, headers=None, retries=3,\n                redirect=True, assert_same_host=True):\n        if headers is None:\n            headers = {}\n        headers['Connection'] = 'Keep-Alive'\n        return super(NTLMConnectionPool, self).urlopen(method, url, body,\n                                                       headers, retries,\n                                                       redirect,\n                                                       assert_same_host)\n","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/arduino/Arduino/blob/a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee/arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/contrib/ntlmpool.py#L85-L121","documentation":"During the second leg of the NTLM handshake, after urllib3 sends the NTLM AUTHENTICATE message with the user's credentials, ntlmpool._new_conn checks the final response status. A 401 means the server rejected the credentials, so the pool raises this Exception indicating wrong username or password.","triggerScenarios":"Any request through NTLMConnectionPool where the username/password (or Windows domain) supplied to the pool is wrong, expired, or locked out — the server responds 401 after the NTLM authenticate message.","commonSituations":"Password recently changed or expired; wrong domain format (DOMAIN\\\\user vs user@domain); account locked by failed attempts; service account disabled; pointing corporate-credential pools at a test server with different accounts.","solutions":["Verify the credentials by logging in interactively (e.g. Windows logon or another NTLM client) to confirm they are valid.","Check the domain qualifier format: try 'DOMAIN\\\\username' and 'username@domain' forms — some servers require one or the other.","Confirm the account is not expired/locked and that it is allowed on the target server (AD account status).","Recreate the pool with corrected credentials — NTLMConnectionPool caches connections, so rebuild the pool rather than mutating it."],"exampleFix":"// before\npool = NTLMConnectionPool(host, username='alice', password='old-pw')\n// after\npool = NTLMConnectionPool(host, username='CORP\\\\alice', password='new-correct-pw')","handlingStrategy":"try-catch","validationCode":"def validate_ntlm_credentials(username, password):\n    if not username or not password:\n        raise ValueError('NTLM username and password are required')\n    if '\\\\' not in username and '@' not in username:\n        raise ValueError(\"Use 'DOMAIN\\\\user' or 'user@domain' format for NTLM credentials\")","typeGuard":"def looks_like_domain_account(username):\n    return isinstance(username, str) and ('\\\\' in username or '@' in username)","tryCatchPattern":"try:\n    resp = ntlm_pool.urlopen('GET', path)\nexcept Exception as e:\n    if 'wrong username or password' in str(e):\n        log.error('NTLM credentials rejected; refresh username/password/domain')\n        raise AuthFailure(str(e)) from None\n    raise","preventionTips":["Store NTLM credentials in a secret manager and refresh them on password rotation.","Test credentials interactively or with curl --ntlm before deploying.","Use the DOMAIN\\\\user or user@domain form consistently for your environment.","Lock guard rails: stop retrying after one 401 to avoid account lockout."],"tags":["python","ntlm","authentication","credentials"],"backgroundTag":"missing-credentials","analyzedSha":"a0df6e0e83b652c72bc78b0a1376c54d6ebc3bee","analyzedAt":"2026-09-06T10:13:38.901Z","contentChangedAt":"2026-09-06T10:13:38.901Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}