{"record":{"id":"dab1f520438a9fc8","repo":"flowable/flowable-engine","slug":"authentication-failed-for-this-username-and-passwo-dab1f5","errorCode":null,"errorMessage":"Authentication failed for this username and password","messagePattern":"Authentication failed for this username and password","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"modules/flowable-spring-security/src/main/java/org/flowable/spring/security/FlowableAuthenticationProvider.java","lineNumber":46,"sourceCode":" */\npublic class FlowableAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {\n\n    protected final IdmIdentityService idmIdentityService;\n    protected final UserDetailsService userDetailsService;\n\n    public FlowableAuthenticationProvider(IdmIdentityService idmIdentityService, UserDetailsService userDetailsService) {\n        this.idmIdentityService = idmIdentityService;\n        this.userDetailsService = userDetailsService;\n    }\n\n    @Override\n    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {\n        String name = userDetails.getUsername();\n        String password = authentication.getCredentials().toString();\n\n        boolean authenticated = idmIdentityService.checkPassword(name, password);\n        if (!authenticated) {\n            throw new BadCredentialsException(\"Authentication failed for this username and password\");\n        }\n    }\n\n    @Override\n    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {\n        return userDetailsService.loadUserByUsername(username);\n    }\n}\n","sourceCodeStart":28,"sourceCodeEnd":55,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-spring-security/src/main/java/org/flowable/spring/security/FlowableAuthenticationProvider.java#L28-L55","documentation":"FlowableAuthenticationProvider's additionalAuthenticationChecks delegates password validation to the Flowable IDM IdentityService.checkPassword. If the IDM service says the username/password pair is not valid, it throws Spring Security's BadCredentialsException with this message. This mirrors Spring Security's standard bad-credentials contract.","triggerScenarios":"AuthenticationManager.authenticate(UsernamePasswordAuthenticationToken) is invoked with credentials that fail idmIdentityService.checkPassword for the resolved UserDetails.","commonSituations":"Typo in password or username; user exists in Spring's UserDetailsService but the IDM identity store has a different/no password; password hashing mismatch between IDM config and stored hash; user provisioned without a password.","solutions":["Verify the credentials against the IDM user store (ACT_ID_USER table) and re-enter the correct password","Confirm the IDM user's password hash matches the configured password encoder (e.g. re-hash after encoder change)","Ensure user provisioning code sets a password in the IDM identity service","Check for case sensitivity or realm/tenant mismatch between the login form and IDM data"],"exampleFix":"// before: user created without password\nidentityService.newUser(\"admin\");\n// after\nUser u = identityService.newUser(\"admin\");\nu.setPassword(\"secret\");\nidentityService.saveUser(u);","handlingStrategy":"try-catch","validationCode":"boolean ok = idmIdentityService.checkPassword(username, rawPassword);\nif (!ok) { throw new BadCredentialsException(\"Bad credentials\"); }","typeGuard":null,"tryCatchPattern":"try { authManager.authenticate(token); } catch (BadCredentialsException e) { /* return 401 / show 'invalid username or password' without leaking which part failed */ }","preventionTips":["Provision IDM users with hashed passwords matching the configured encoder","Re-hash stored passwords after encoder changes","Never reveal whether username or password was wrong","Add integration tests covering login against real IDM data"],"tags":["authentication","spring-security","credentials"],"backgroundTag":"authentication-required","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}