{"record":{"id":"a70fb6d75a79e3ec","repo":"prestodb/presto","slug":"invalid-credentials","errorCode":null,"errorMessage":"Invalid credentials","messagePattern":"Invalid credentials","errorType":"http","errorClass":"AccessDeniedException","httpStatus":401,"severity":"warning","filePath":"presto-password-authenticators/src/main/java/com/facebook/presto/password/file/FileAuthenticator.java","lineNumber":56,"sourceCode":"    {\n        File file = config.getPasswordFile();\n        if (!file.exists()) {\n            log.error(\"File %s does not exist\", file.getAbsolutePath());\n            throw new FileNotFoundException(\"File \" + file.getAbsolutePath() + \" does not exist\");\n        }\n        int cacheMaxSize = config.getAuthTokenCacheMaxSize();\n\n        passwordStoreSupplier = memoizeWithExpiration(\n                () -> new PasswordStore(file, cacheMaxSize),\n                config.getRefreshPeriod().toMillis(),\n                MILLISECONDS);\n    }\n\n    @Override\n    public Principal createAuthenticatedPrincipal(String user, String password)\n    {\n        if (!passwordStoreSupplier.get().authenticate(user, password)) {\n            throw new AccessDeniedException(\"Invalid credentials\");\n        }\n\n        return new BasicPrincipal(user);\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":62,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-password-authenticators/src/main/java/com/facebook/presto/password/file/FileAuthenticator.java#L38-L62","documentation":"FileAuthenticator.createAuthenticatedPrincipal throws AccessDeniedException(\"Invalid credentials\") when the user's password does not match any entry in the configured password file. It is the standard authentication-rejection path for the file-based password authenticator: the credentials supplied over HTTPS basic auth failed the hash comparison.","triggerScenarios":"A client sends a username/password during TLS basic authentication and FilePasswordStore.authenticate() returns false because the bcrypt/pbkdf2 hash for that user does not match the supplied password, or the user has no entry in the password file.","commonSituations":"Typo in the client's configured credentials; password file regenerated or user entry removed while a client still uses an old credential; password stored with an unsupported hash format; client pointing at the wrong coordinator with a different password file.","solutions":["Verify the client credentials (user and password) are correct and match an entry in the configured password file","Regenerate or update the user's entry in the password file with the correct hash (bcrypt or PBKDF2-WORKOUT/S) and reload so PasswordStore re-reads it","Confirm the hash algorithm of the stored entry is supported (bcrypt or PBKDF2, not plaintext or crypt)","Check the coordinator config (file.password-file path) points at the intended file"],"exampleFix":"// before\nString password = \"stale-password\"; // changed on server, auth fails\n// after\nString password = System.getenv(\"PRESTO_PASSWORD\"); // kept in sync with server password file","handlingStrategy":"validation","validationCode":"// Before deploying client config, verify credentials against the same file the server uses:\n// htpasswd -vb /etc/presto/password.db <user> <password>  (exit code 0 => hash matches)","typeGuard":null,"tryCatchPattern":"try {\n    principal = authenticator.createAuthenticatedPrincipal(user, password);\n} catch (AccessDeniedException e) {\n    log.warn(\"Auth rejected for user %s\", user); // do not leak whether user exists\n    throw new WebApplicationException(Status.UNAUTHORIZED);\n}","preventionTips":["Keep client credentials in a secrets manager and rotate them together with the server password file","Test the hash with htpasswd -vb before shipping a new password file","Never store plaintext or unsupported hashes in the password file","Alert on AccessDeniedException rates to catch misconfigured clients early"],"tags":["authentication","access-denied","password-file","credentials"],"backgroundTag":"invalid-credentials","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}