{"record":{"id":"f120141d297cbc8c","repo":"flowable/flowable-engine","slug":"authentication-failed-for-this-username-and-passwo-f12014","errorCode":null,"errorMessage":"Authentication failed for this username and password","messagePattern":"Authentication failed for this username and password","errorType":"http","errorClass":"BadCredentialsException","httpStatus":401,"severity":"error","filePath":"modules/flowable-event-registry-rest/src/main/java/org/flowable/eventregistry/rest/security/BasicAuthenticationProvider.java","lineNumber":51,"sourceCode":"    @Autowired\n    @Lazy\n    private IdmIdentityService identityService;\n\n    @Override\n    public Authentication authenticate(Authentication authentication) throws AuthenticationException {\n        String name = authentication.getName();\n        String password = authentication.getCredentials().toString();\n\n        boolean authenticated = identityService.checkPassword(name, password);\n        if (authenticated) {\n            List<Group> groups = identityService.createGroupQuery().groupMember(name).list();\n            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();\n            for (Group group : groups) {\n                grantedAuthorities.add(new SimpleGrantedAuthority(group.getId()));\n            }\n            return new UsernamePasswordAuthenticationToken(name, password, grantedAuthorities);\n        } else {\n            throw new BadCredentialsException(\"Authentication failed for this username and password\");\n        }\n    }\n\n    @Override\n    public boolean supports(Class<?> authentication) {\n        return authentication.equals(UsernamePasswordAuthenticationToken.class);\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":60,"githubUrl":"https://github.com/flowable/flowable-engine/blob/d6d39ce1c69ff244f2d9dc6af756a9b95e865586/modules/flowable-event-registry-rest/src/main/java/org/flowable/eventregistry/rest/security/BasicAuthenticationProvider.java#L33-L60","documentation":"Spring Security BadCredentialsException thrown by the event-registry REST app's BasicAuthenticationProvider when the user exists but the password (or user validation) fails during HTTP Basic authentication. It deliberately gives no detail about which of username/password was wrong.","triggerScenarios":"An HTTP request to the event-registry REST API carries a Basic auth header whose username/password do not authenticate: additionalAuthenticationChecks or the user check returns false, so authenticate() throws instead of returning the UsernamePasswordAuthenticationToken.","commonSituations":"Wrong credentials in the REST client or environment; password changed or expired on the server; credentials encoded with the wrong scheme in the Authorization header; misconfigured users file/LDAP.","solutions":["Verify the username and password used in the Basic auth header against the configured user store","Re-encode the header correctly: Base64 of 'username:password' sent as 'Authorization: Basic ...'","Check server-side user configuration (flowable.rest.app.authentication-mode, LDAP properties) for changes","Confirm the account is not locked/disabled and the credentials file was reloaded after changes"],"exampleFix":"// before\ncurl -u admin:wrongpass http://localhost:8080/flowable-event-registry/rest/... \n// after\ncurl -u admin:secret http://localhost:8080/flowable-event-registry/rest/...","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    ResponseEntity<String> resp = rest.exchange(url, HttpMethod.GET, new HttpEntity<>(headers), String.class);\n} catch (HttpClientErrorException.Unauthorized e) {\n    logger.error(\"Event registry REST auth failed; check username/password\");\n    throw new RestAuthenticationException(e);\n}","preventionTips":["Store REST credentials in a secrets manager and rotate with the server-side config","Test credentials with a cheap endpoint before critical calls","Verify the Authorization header is 'Basic ' + Base64(username:password)","Check that the account is enabled and the auth provider (in-memory/LDAP) config matches the server"],"tags":["http","security","authentication","basic-auth"],"backgroundTag":"authentication-failed","analyzedSha":"d6d39ce1c69ff244f2d9dc6af756a9b95e865586","analyzedAt":"2026-09-11T06:41:19.413Z","contentChangedAt":"2026-09-11T06:41:19.413Z","schemaVersion":2},"datasetVersion":"2026-09-18T11:17:12.947Z"}