{"record":{"id":"94496cf6158d98b4","repo":"microsoft/semantic-kernel","slug":"invalid-credentials","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py","lineNumber":175,"sourceCode":"        \"\"\"Handle simple authentication callback and return redirect URI.\"\"\"\n        state_data = self.state_mapping.get(state)\n        if not state_data:\n            raise HTTPException(400, \"Invalid state parameter\")\n\n        redirect_uri = state_data[\"redirect_uri\"]\n        code_challenge = state_data[\"code_challenge\"]\n        redirect_uri_provided_explicitly = state_data[\"redirect_uri_provided_explicitly\"] == \"True\"\n        client_id = state_data[\"client_id\"]\n        resource = state_data.get(\"resource\")  # RFC 8707\n\n        # These are required values from our own state mapping\n        assert redirect_uri is not None\n        assert code_challenge is not None\n        assert client_id is not None\n\n        # Validate demo credentials\n        if username != self.settings.demo_username or password != self.settings.demo_password:\n            raise HTTPException(401, \"Invalid credentials\")\n\n        # Create MCP authorization code\n        new_code = f\"mcp_{secrets.token_hex(16)}\"\n        auth_code = AuthorizationCode(\n            code=new_code,\n            client_id=client_id,\n            redirect_uri=AnyHttpUrl(redirect_uri),\n            redirect_uri_provided_explicitly=redirect_uri_provided_explicitly,\n            expires_at=time.time() + 300,\n            scopes=[self.settings.mcp_scope],\n            code_challenge=code_challenge,\n            resource=resource,  # RFC 8707\n        )\n        self.auth_codes[new_code] = auth_code\n\n        # Store user data\n        self.user_data[username] = {\n            \"username\": username,","sourceCodeStart":157,"sourceCodeEnd":193,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/samples/demos/mcp_with_oauth/server/mcp_simple_auth/simple_auth_provider.py#L157-L193","documentation":"Thrown by the MCP OAuth sample after the state is validated but the submitted username/password do not equal the configured demo credentials (self.settings.demo_username / demo_password). It is a plain HTTP 401 rejecting the login form submission. The sample uses fixed demo credentials, not a real user store.","triggerScenarios":"Submitting the /login/callback form with credentials that differ from settings.demo_username/demo_password; leaving the .env values at defaults while typing other values; misconfigured DEMO_USERNAME/DEMO_PASSWORD env vars.","commonSituations":"Developer changed the demo credential env vars on the server but submitted the old defaults shown in the form HTML; form pre-fills 'demo_user'/'demo_password' but env was overridden to something else; copy-paste whitespace differences.","solutions":["Use the exact demo credentials the server is configured with — check DEMO_USERNAME and DEMO_PASSWORD in the server's env/.env and match them exactly.","Use the pre-filled defaults in the rendered login form (demo_user / demo_password) if you have not customized the env.","Trim leading/trailing whitespace from submitted values and confirm no caps-lock/autocorrect altered the password.","Restart the server after editing .env so the new settings are loaded."],"exampleFix":"# .env for the sample server\nDEMO_USERNAME=demo_user\nDEMO_PASSWORD=demo_password\n# Submit exactly these in the login form.","handlingStrategy":"validation","validationCode":"import os\nassert os.getenv('DEMO_USERNAME'), 'DEMO_USERNAME not set'\nassert os.getenv('DEMO_PASSWORD'), 'DEMO_PASSWORD not set\n# Submit exactly these values in the login form.","typeGuard":null,"tryCatchPattern":"try:\n    redirect = await provider.handle_simple_callback(username, password, state)\nexcept HTTPException as e:\n    if e.status_code == 401:\n        # surface 'check DEMO_USERNAME/DEMO_PASSWORD' to the user\n        ...\n    raise","preventionTips":["Echo the configured demo credentials into the login form so testers copy them exactly.","Restart the server after editing .env so new demo credentials load.","Trim whitespace from env values.","Keep a note of the current demo credentials next to the sample."],"tags":["oauth","mcp","authentication","credentials","http-401","demo"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}