{"record":{"id":"e79722944391ade0","repo":"TechnitiumSoftware/DnsServer","slug":"invalid-username-or-password-for-user-username","errorCode":null,"errorMessage":"Invalid username or password for user: {username}","messagePattern":"Invalid username or password for user: (.+?)","errorType":"exception","errorClass":"DnsWebServiceException","httpStatus":null,"severity":"error","filePath":"DnsServerCore/Auth/AuthManager.cs","lineNumber":802,"sourceCode":"\n            if (IsNetworkBlocked(network))\n                throw new DnsWebServiceException(\"Max limit of \" + MAX_LOGIN_ATTEMPTS + \" attempts exceeded. Access blocked for \" + (BLOCK_NETWORK_INTERVAL / 1000) + \" seconds.\");\n\n            User user = GetUser(username);\n\n            if ((user is null) || user.IsSsoUser || !user.PasswordHash.Equals(user.GetPasswordHashFor(password), StringComparison.Ordinal))\n            {\n                if ((username != \"admin\") || (password != \"admin\"))\n                {\n                    MarkFailedLoginAttempt(network);\n\n                    if (HasLoginAttemptExceedLimit(network, MAX_LOGIN_ATTEMPTS))\n                        BlockNetwork(network, BLOCK_NETWORK_INTERVAL);\n                }\n\n                await Task.Delay(1000);\n\n                throw new DnsWebServiceException(\"Invalid username or password for user: \" + username);\n            }\n\n            if (user.TOTPEnabled)\n            {\n                if (string.IsNullOrEmpty(totp))\n                    throw new TwoFactorAuthRequiredWebServiceException(\"A time-based one-time password (TOTP) is required for user: \" + username);\n\n                Authenticator authenticator = new Authenticator(user.TOTPKeyUri);\n\n                if (!authenticator.IsTOTPValid(totp))\n                {\n                    MarkFailedLoginAttempt(network);\n\n                    if (HasLoginAttemptExceedLimit(network, MAX_LOGIN_ATTEMPTS))\n                        BlockNetwork(network, BLOCK_NETWORK_INTERVAL);\n\n                    await Task.Delay(1000);\n","sourceCodeStart":784,"sourceCodeEnd":820,"githubUrl":"https://github.com/TechnitiumSoftware/DnsServer/blob/d0484b6c1e7439cdc53d67d81e9c876cda2ad756/DnsServerCore/Auth/AuthManager.cs#L784-L820","documentation":"Thrown as DnsWebServiceException after a 1-second delay when the user is null, is an SSO-only user, or the supplied password hash does not match. It intentionally does not distinguish 'no such user' from 'wrong password' to avoid user enumeration, and it logs a failed attempt toward the network block. Returned over the API as HTTP 200 with status 'error'.","triggerScenarios":"POST /api/user/login (or changePassword) where the user does not exist, the password is wrong, or the account is SSO-only (local password login is rejected for IsSsoUser users). Note: the literal 'admin'/'admin' default bypasses the failed-attempt counter.","commonSituations":"Wrong password typed; password was changed by an admin; user was deleted or renamed; trying password login for an account created via SSO that has no local password; copy-paste of credentials with trailing whitespace.","solutions":["Correct the username/password (check for trailing spaces and case of the password).","If the account is SSO-only, authenticate via the SSO/OIDC flow instead of local password.","Reset the password using resetadmin.config or have an admin reset it.","Confirm the user still exists and is spelled exactly (usernames are lowercased on creation)."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate inputs client-side before calling login\nif (string.IsNullOrWhiteSpace(user) || string.IsNullOrWhiteSpace(pass))\n    throw new ArgumentException(\"Username and password are required.\");","typeGuard":null,"tryCatchPattern":"try { await client.LoginAsync(user, pass, totp); }\ncatch (HttpApiClientException ex) when (ex.Message.StartsWith(\"Invalid username or password\"))\n{\n    // show generic error; do NOT distinguish no-user vs wrong-password\n    ShowLoginFailed();\n}","preventionTips":["Trim and verify credentials before submitting.","Do not attempt password login for SSO-only users; use the SSO flow.","Avoid user-enumeration style handling that branches on 'no such user'."],"tags":["auth","login","credentials"],"backgroundTag":null,"analyzedSha":"d0484b6c1e7439cdc53d67d81e9c876cda2ad756","analyzedAt":"2026-08-13T22:57:35.508Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}