{"record":{"id":"e11bad82a8d6707a","repo":"apache/seatunnel","slug":"auth-failed","errorCode":"AUTH_FAILED","errorMessage":"HTTP \" + status + \": \" + body","messagePattern":"HTTP \" \\+ status \\+ \": \" \\+ body","errorType":"error_code","errorClass":"SalesforceConnectorException","httpStatus":null,"severity":"critical","filePath":"seatunnel-connectors-v2/connector-salesforce/src/main/java/org/apache/seatunnel/connectors/seatunnel/salesforce/client/SalesforceClient.java","lineNumber":110,"sourceCode":"        String tokenUrl = params.getInstanceUrl() + TOKEN_PATH;\n        HttpPost post = new HttpPost(tokenUrl);\n\n        List<NameValuePair> form = new ArrayList<>();\n        form.add(new BasicNameValuePair(\"grant_type\", \"password\"));\n        form.add(new BasicNameValuePair(\"client_id\", params.getClientId()));\n        form.add(new BasicNameValuePair(\"client_secret\", params.getClientSecret()));\n        form.add(new BasicNameValuePair(\"username\", params.getUsername()));\n        form.add(\n                new BasicNameValuePair(\n                        \"password\", params.getPassword() + params.getSecurityToken()));\n\n        try {\n            post.setEntity(new UrlEncodedFormEntity(form, StandardCharsets.UTF_8));\n            try (CloseableHttpResponse response = httpClient.execute(post)) {\n                int status = response.getStatusLine().getStatusCode();\n                String body = EntityUtils.toString(response.getEntity(), StandardCharsets.UTF_8);\n                if (status != 200) {\n                    throw new SalesforceConnectorException(\n                            SalesforceConnectorErrorCode.AUTH_FAILED,\n                            \"HTTP \" + status + \": \" + body);\n                }\n                JsonNode json = objectMapper.readTree(body);\n                this.accessToken = json.get(\"access_token\").asText();\n                this.authorizedInstanceUrl = json.get(\"instance_url\").asText();\n                log.info(\"Authenticated with Salesforce instance {}\", authorizedInstanceUrl);\n            }\n        } catch (SalesforceConnectorException e) {\n            throw e;\n        } catch (Exception e) {\n            throw new SalesforceConnectorException(SalesforceConnectorErrorCode.AUTH_FAILED, e);\n        }\n    }\n\n    public CatalogTable describeObject(String database, String objectName) {\n        String url =\n                authorizedInstanceUrl","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/apache/seatunnel/blob/cf67b549a7a6c35fa0beb12d83c62892427ea919/seatunnel-connectors-v2/connector-salesforce/src/main/java/org/apache/seatunnel/connectors/seatunnel/salesforce/client/SalesforceClient.java#L92-L128","documentation":"SalesforceClient.authenticate posts the OAuth credentials to Salesforce's token endpoint and requires HTTP 200. Any other status throws SalesforceConnectorException(AUTH_FAILED) with the status code and response body, since the token exchange did not yield an access token.","triggerScenarios":"The OAuth token POST returns non-200 — invalid client_id/client_secret, wrong username/password, expired or revoked refresh token, locked account, or the authorized endpoint URL is wrong. Raised in authenticate() before any data flows.","commonSituations":"Rotated Salesforce passwords invalidating security tokens, IP not in Salesforce trusted ranges, sandbox vs production login URL mixups, or expired connected-app credentials.","solutions":["Read the response body in the error message — Salesforce returns e.g. {\"error\":\"invalid_grant\",\"error_description\":\"...\"} and fix the matching credential","Verify client_id, client_secret, username, password+security_token against the connected app in Salesforce setup","Confirm the auth endpoint URL (login vs test/sandbox: https://login.salesforce.com vs https://test.salesforce.com)","If using refresh tokens, re-run the OAuth flow to obtain a fresh token"],"exampleFix":"// before\nauth_url = \"https://login.salesforce.com/services/oauth2/token\" // sandbox user\n// after\nauth_url = \"https://test.salesforce.com/services/oauth2/token\"","handlingStrategy":"try-catch","validationCode":"// Pre-flight token request before the job\ncurl -X POST $AUTH_URL -d grant_type=password -d client_id=... -d client_secret=...\n// expect HTTP 200 with access_token","typeGuard":null,"tryCatchPattern":"try {\n    client.authenticate();\n} catch (SalesforceConnectorException e) {\n    if (e.getSeaTunnelErrorCode() == SalesforceConnectorErrorCode.AUTH_FAILED) {\n        // parse e.getMessage() body: refresh credentials or re-run OAuth flow\n    } else throw e;\n}","preventionTips":["Match login vs test.salesforce.com to the user's environment","Append the user's security token to the password when required","Whitelist worker IPs in Salesforce network access settings","Rotate refresh tokens before expiry and monitor 401/400 bodies in errors"],"tags":["http","oauth","salesforce","authentication"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"cf67b549a7a6c35fa0beb12d83c62892427ea919","analyzedAt":"2026-09-10T21:44:55.265Z","contentChangedAt":"2026-09-10T21:44:55.265Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}