{"record":{"id":"f16de2fa80970a36","repo":"apereo/cas","slug":"account-password-on-record-for-does-not-match","errorCode":null,"errorMessage":"Account password on record for [{}] does not match the given password","messagePattern":"Account password on record for \\[(.+?)\\] does not match the given password","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-cassandra-authentication/src/main/java/org/apereo/cas/authentication/CassandraAuthenticationHandler.java","lineNumber":50,"sourceCode":"\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        @Nullable final String originalPassword) throws Throwable {\n        val username = credential.getUsername();\n        val attributes = this.cassandraRepository.getUser(username);\n\n        if (attributes == null || attributes.isEmpty()\n            || !attributes.containsKey(cassandraAuthenticationProperties.getUsernameAttribute())\n            || !attributes.containsKey(cassandraAuthenticationProperties.getPasswordAttribute())) {\n            LOGGER.warn(\"Unable to find account [{}]: The account does not exist or it's missing username/password attributes\", username);\n            throw new AccountNotFoundException();\n        }\n\n        LOGGER.debug(\"Located account attributes [{}] for [{}]\", attributes.keySet(), username);\n        val entryPassword = attributes.get(cassandraAuthenticationProperties.getPasswordAttribute()).getFirst().toString();\n\n        if (!getPasswordEncoder().matches(originalPassword, entryPassword)) {\n            LOGGER.warn(\"Account password on record for [{}] does not match the given password\", username);\n            throw new FailedLoginException();\n        }\n        val principal = this.principalFactory.createPrincipal(username, attributes);\n        return createHandlerResult(credential, principal, new ArrayList<>());\n    }\n}\n","sourceCodeStart":32,"sourceCodeEnd":57,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-cassandra-authentication/src/main/java/org/apereo/cas/authentication/CassandraAuthenticationHandler.java#L32-L57","documentation":"CassandraAuthenticationHandler logs this warning when the stored password attribute for the user does not match the presented credential after encoding/matching via getPasswordEncoder().matches(). It throws FailedLoginException, meaning the account exists but the password is wrong.","triggerScenarios":"authenticateUsernamePasswordInternal retrieves the entry password from the configured password attribute and passwordEncoder.matches(originalPassword, entryPassword) returns false.","commonSituations":"User typed a wrong password; stored hash was generated with a different encoding/algorithm than the configured password encoder (e.g. plain vs bcrypt); password changed upstream but stale in Cassandra; password attribute column contains extra whitespace or a prefix/salt format the encoder does not expect.","solutions":["Verify the user is submitting the correct credentials.","Align cas.authn.password-encoder.type/encoding with how passwords are stored in Cassandra (e.g. bcrypt vs plaintext).","Re-hash or correct the stored password for the account if it was seeded manually.","Inspect the stored value format (trailing whitespace, algorithm prefix) and normalize it."],"exampleFix":"// before: stored plaintext, encoder mismatch\ncas.authn.password-encoder.type=BCRYPT\n// after: matches plaintext storage\ncas.authn.password-encoder.type=NONE\ncas.authn.password-encoder.encoding=UTF-8","handlingStrategy":"try-catch","validationCode":"// sanity-check encoder vs storage before enabling handler\nif (encoder.getType() != storedHashScheme) {\n  throw new IllegalStateException(\"password encoder mismatch: \" + encoder.getType());\n}","typeGuard":null,"tryCatchPattern":"try {\n  return handler.authenticateUsernamePasswordInternal(credential);\n} catch (FailedLoginException e) {\n  LOGGER.warn(\"Bad password for [{}] (encoder={})\", credential.getUsername(), encoderType);\n  return AuthenticationHandlerResult.badPassword(credential);\n}","preventionTips":["Ensure the configured password encoder type matches how passwords are stored/hashed in Cassandra.","Validate seeded account hashes with a known-good password in an integration test.","Audit stored password values for whitespace, prefixes, or stale formats after migrations.","Provide clear user feedback distinguishing unknown account from bad password where policy allows."],"tags":["cassandra","authentication","bad-password"],"backgroundTag":"invalid-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}