{"record":{"id":"b2b4677774edc454","repo":"phacility/phabricator","slug":"username-and-password-are-required","errorCode":null,"errorMessage":"Username and password are required!","messagePattern":"Username and password are required!","errorType":"validation","errorClass":"Exception","httpStatus":null,"severity":"warning","filePath":"src/applications/auth/provider/PhabricatorLDAPAuthProvider.php","lineNumber":170,"sourceCode":"      return array($account, $response);\n    }\n\n    if ($request->isFormPost()) {\n      try {\n        if (strlen($username) && $has_password) {\n          $adapter = $this->getAdapter();\n          $adapter->setLoginUsername($username);\n          $adapter->setLoginPassword($password);\n\n          // TODO: This calls ldap_bind() eventually, which dumps cleartext\n          // passwords to the error log. See note in PhutilLDAPAuthAdapter.\n          // See T3351.\n\n          DarkConsoleErrorLogPluginAPI::enableDiscardMode();\n            $identifiers = $adapter->getAccountIdentifiers();\n          DarkConsoleErrorLogPluginAPI::disableDiscardMode();\n        } else {\n          throw new Exception(pht('Username and password are required!'));\n        }\n      } catch (PhutilAuthCredentialException $ex) {\n        $response = $controller->buildProviderPageResponse(\n          $this,\n          $this->renderLoginForm($request, 'login'));\n        return array($account, $response);\n      } catch (Exception $ex) {\n        // TODO: Make this cleaner.\n        throw $ex;\n      }\n    }\n\n    $account = $this->newExternalAccountForIdentifiers($identifiers);\n\n    return array($account, $response);\n  }\n\n","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/provider/PhabricatorLDAPAuthProvider.php#L152-L188","documentation":"Thrown from PhabricatorLDAPAuthProvider's login processing when the submitted login form has no username or no password (the code paths that populate both were not taken, so it raises this Exception instead of attempting an LDAP bind with empty credentials). It is a plain Exception thrown while building the login response, before any LDAP communication happens.","triggerScenarios":"Submitting the LDAP login form with one or both fields empty; a custom client (API script, mobile app, or automated POST) hitting the LDAP login endpoint without both credentials; a form where JavaScript validation was bypassed or the field names do not match what the provider reads.","commonSituations":"Automated clients posting to the login endpoint with missing parameters; accessibility tools or password managers failing to fill one field; a customized login template that renamed or dropped an input; users submitting the form prematurely.","solutions":["Fill in both the username and password fields and resubmit the form normally.","If driving Phabricator programmatically, stop using the LDAP form endpoint with raw POSTs — use Conduit API tokens or a real browser-level flow, and always send both fields if you must POST.","Check any customized login template (field names, required attributes) so both inputs actually reach the provider.","If it happens for real users, add client-side required-field validation on the LDAP login form to give feedback before submission."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Check both fields before submitting/handling the LDAP login form\nif (!strlen($username) || !strlen($password)) {\n  // show 'username and password are required' inline on the form\n  // instead of letting the provider throw\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add required-field validation (HTML5 `required` plus server-side strlen checks) on LDAP login forms.","Do not drive Phabricator auth by POSTing the login form from scripts — use Conduit tokens or session-based flows.","Keep customized login templates in sync with the field names the LDAP provider reads."],"tags":["phabricator","ldap","auth","login","missing-credentials"],"backgroundTag":"missing-credentials","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}