{"record":{"id":"98b4c9237b8e8a65","repo":"Dolibarr/dolibarr","slug":"errorbadloginpassword","errorCode":null,"errorMessage":"ErrorBadLoginPassword","messagePattern":"ErrorBadLoginPassword","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"htdocs/main.inc.php","lineNumber":830,"sourceCode":"\t\t\t\t\t$datesecond = dol_stringtotime($dol_dst_second);\n\t\t\t\t\tif ($datenow >= $datefirst && $datenow < $datesecond) {\n\t\t\t\t\t\t$dol_dst = 1;\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\t$dol_screenheight = empty($_POST[\"screenheight\"]) ? (empty($_GET[\"screenheight\"]) ? (empty($_SESSION[\"dol_screenheight\"]) ? '' : $_SESSION[\"dol_screenheight\"]) : (int) $_GET[\"screenheight\"]) : $_POST[\"screenheight\"];\n\t\t\t\t$dol_screenwidth = empty($_POST[\"screenwidth\"]) ? (empty($_GET[\"screenwidth\"]) ? (empty($_SESSION[\"dol_screenwidth\"]) ? '' : $_SESSION[\"dol_screenwidth\"]) : (int) $_GET[\"screenwidth\"]) : $_POST[\"screenwidth\"];\n\t\t\t\t//print $datefirst.'-'.$datesecond.'-'.$datenow.'-'.$dol_tz.'-'.$dol_tzstring.'-'.$dol_dst.'-'.sdol_screenheight.'-'.sdol_screenwidth; exit;\n\t\t\t}\n\n\t\t\tif (!$login) {\n\t\t\t\tdol_syslog('Bad password, connection refused (see a previous notice message for more info)', LOG_NOTICE);\n\t\t\t\t// Load translation files required by page\n\t\t\t\t$langs->loadLangs(array('main', 'errors'));\n\n\t\t\t\t// Bad password. No authmode has found a good password.\n\t\t\t\t// We set a generic message if not defined inside function checkLoginPassEntity or subfunctions\n\t\t\t\tif (empty($_SESSION[\"dol_loginmesg\"])) {\n\t\t\t\t\t$_SESSION[\"dol_loginmesg\"] = $langs->transnoentitiesnoconv(\"ErrorBadLoginPassword\");\n\t\t\t\t}\n\n\t\t\t\t// Call trigger for the \"security events\" log\n\t\t\t\t$user->context['audit'] = $langs->trans(\"ErrorBadLoginPassword\").' - login='.GETPOST(\"username\", \"alpha\", 2);\n\n\t\t\t\t// Call trigger\n\t\t\t\t$result = $user->call_trigger('USER_LOGIN_FAILED', $user);\n\t\t\t\tif ($result < 0) {\n\t\t\t\t\t$error++;\n\t\t\t\t}\n\t\t\t\t// End call triggers\n\n\t\t\t\t// Hooks on failed login\n\t\t\t\t$action = '';\n\t\t\t\t$hookmanager->initHooks(array('login'));\n\t\t\t\t$parameters = array('dol_authmode' => $dol_authmode, 'dol_loginmesg' => $_SESSION[\"dol_loginmesg\"]);\n\t\t\t\t$reshook = $hookmanager->executeHooks('afterLoginFailed', $parameters, $user, $action); // Note that $action and $object may have been modified by some hooks\n\t\t\t\tif ($reshook < 0) {","sourceCodeStart":812,"sourceCodeEnd":848,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/main.inc.php#L812-L848","documentation":"No authentication mode succeeded in validating the username/password/entity combination, and no more specific message was set by checkLoginPassEntity or its subfunctions, so Dolibarr stores the generic ErrorBadLoginPassword message. This is the standard wrong-credentials outcome of the login flow.","triggerScenarios":"POSTed username/password do not match any user for the requested entity under the configured authmodes (dolibarr, ldap, http, oauth...); checkLoginPassEntity returns failure without setting dol_loginmesg.","commonSituations":"Users typing wrong passwords or having expired/disabled accounts; wrong entity (multicompany) selection; auth mode misconfiguration (e.g. LDAP bind issues surfacing as bad login); users migrated between entities.","solutions":["Verify the username/password and re-enter them.","Check the correct entity/company is selected on multi-entity installs.","Confirm the account is enabled and not expired (user card in admin).","Validate $dolibarr_main_authentication and its backend (LDAP/HTTP) works.","Check the security audit/trigger logs to distinguish a typo from a backend failure."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the forgot-password flow instead of repeated attempts (lockout/audit)","Test LDAP/auth backends separately with a CLI check before pointing users at them","On multicompany, document which entity users must select"],"tags":["dolibarr","login","credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}