{"record":{"id":"a03960257e337285","repo":"apereo/cas","slug":"account-password-on-file-does-not-match-the-provid","errorCode":null,"errorMessage":"Account password on file does not match the provided password for [{}]","messagePattern":"Account password on file does not match the provided password for \\[(.+?)\\]","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-generic/src/main/java/org/apereo/cas/adaptors/generic/JsonResourceAuthenticationHandler.java","lineNumber":68,"sourceCode":"        super(name, principalFactory, order);\n        this.resource = resource;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential credential, final String originalPassword) throws Throwable {\n\n        val map = readAccountsFromResource();\n        val username = credential.getUsername();\n        LOGGER.debug(\"Attempting to authenticate [{}]\", username);\n        if (!map.containsKey(username)) {\n            LOGGER.debug(\"Unable to locate user account for [{}]\", username);\n            throw new AccountNotFoundException();\n        }\n\n        val account = map.get(username);\n        if (!matches(originalPassword, account.getPassword())) {\n            LOGGER.warn(\"Account password on file does not match the provided password for [{}]\", username);\n            throw new FailedLoginException();\n        }\n\n        LOGGER.debug(\"Located account [{}]\", account);\n        switch (account.getStatus()) {\n            case DISABLED -> throw new AccountDisabledException();\n            case EXPIRED -> throw new AccountExpiredException();\n            case LOCKED -> throw new AccountLockedException();\n            case MUST_CHANGE_PASSWORD -> throw new AccountPasswordMustChangeException();\n            case OK -> LOGGER.debug(\"Account status is OK\");\n        }\n\n        val clientInfo = ClientInfoHolder.getClientInfo();\n        if (clientInfo != null && StringUtils.isNotBlank(account.getLocation())\n            && !RegexUtils.find(account.getLocation(), clientInfo.getClientIpAddress())) {\n            throw new InvalidLoginLocationException(\"Unable to login from this location\");\n        }\n","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-generic/src/main/java/org/apereo/cas/adaptors/generic/JsonResourceAuthenticationHandler.java#L50-L86","documentation":"JsonResourceAuthenticationHandler authenticates users from a JSON resource map of username to account. When the submitted password does not match the stored hash/password for the located username, it logs this warning and throws FailedLoginException, resulting in an authentication failure for the user.","triggerScenarios":"authenticateUsernamePasswordInternal finds the username in the JSON map, but matches(originalPassword, account.getPassword()) returns false - wrong password typed, stale JSON data, or mismatched password-encoder configuration.","commonSituations":"User typo or forgotten password; JSON file edited by hand with plaintext while the handler expects an encoded password (or vice versa); PasswordEncoder changed in config but JSON data not migrated; wrong JSON resource loaded in the target environment.","solutions":["Verify the user is typing the correct password; reset it in the JSON resource if needed","Confirm the password format in the JSON matches the configured PasswordEncoder (e.g. SHA/BCrypt vs plaintext)","Regenerate the stored hash after any password-encoder change","Check that the JSON resource path points to the intended environment's file"],"exampleFix":"// before\n{\"admin\": {\"password\": \"plaintext\", \"status\": \"OK\"}}\n// after (with BCrypt encoder configured)\n{\"admin\": {\"password\": \"$2a$10$N9qo8uLOickgx2ZMRZoMye...\", \"status\": \"OK\"}}","handlingStrategy":"validation","validationCode":"var account = userMap.get(username);\nif (account == null) throw new AccountNotFoundException();\nif (!passwordEncoder.matches(rawPassword, account.getPassword())) {\n    LOGGER.warn(\"password mismatch for {}\", username);\n}","typeGuard":null,"tryCatchPattern":"try {\n    handler.authenticate(transaction);\n} catch (FailedLoginException e) {\n    handleBadPassword(username);\n} catch (AccountDisabledException e) {\n    handleDisabled(username);\n}","preventionTips":["Keep password hashes in the JSON file consistent with the configured PasswordEncoder","Regenerate hashes after any encoder change","Point environments at the correct JSON resource and version-control it"],"tags":["authentication","json-resource","password-mismatch","failed-login"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}