{"record":{"id":"f395641d087f2368","repo":"apereo/cas","slug":"account-password-on-record-for-does-not-match-f39564","errorCode":null,"errorMessage":"Account password on record for [{}] does not match the given/encoded password","messagePattern":"Account password on record for \\[(.+?)\\] does not match the given/encoded password","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java","lineNumber":53,"sourceCode":"    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        @Nullable final String originalPassword) throws Throwable {\n\n        val username = credential.getUsername();\n\n        val attributes = repository.getUser(username);\n\n        if (attributes == null || attributes.isEmpty()\n            || !attributes.containsKey(cloudDirectoryProperties.getUsernameAttributeName())\n            || !attributes.containsKey(cloudDirectoryProperties.getPasswordAttributeName())) {\n            LOGGER.warn(\"Unable to find account [{}]: The account does not exist or it's missing username/password attributes\", username);\n            throw new AccountNotFoundException();\n        }\n\n        LOGGER.debug(\"Located account attributes [{}] for [{}]\", attributes.keySet(), username);\n\n        val userPassword = attributes.get(cloudDirectoryProperties.getPasswordAttributeName()).getFirst().toString();\n        if (!matches(Objects.requireNonNull(originalPassword), userPassword)) {\n            LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", username);\n            throw new FailedLoginException();\n        }\n        val principal = this.principalFactory.createPrincipal(username, attributes);\n        return createHandlerResult(credential, principal, new ArrayList<>());\n    }\n}\n","sourceCodeStart":35,"sourceCodeEnd":60,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java#L35-L60","documentation":"AmazonCloudDirectoryAuthenticationHandler logs this warning when the password stored in the Cloud Directory user attributes does not match the presented password per matches(originalPassword, userPassword). It throws FailedLoginException: the account was found but credentials are invalid.","triggerScenarios":"authenticateUsernamePasswordInternal reads the configured password attribute and matches() (via the handler's password comparison/encoder) returns false.","commonSituations":"Wrong password entered; stored password hashed with a scheme the configured password encoder does not expect; attribute contains salt-prefix formats incompatible with the encoder; password updated in Cloud Directory but cached/replicated values stale.","solutions":["Confirm the submitted password is correct for the account.","Set cas.authn.password-encoder.type to the algorithm matching stored hashes (e.g. BCRYPT, SSHA).","Re-provision/correct the stored password attribute if it was seeded incorrectly.","Inspect the raw stored attribute value for unexpected prefixes, salts, or whitespace."],"exampleFix":"// before\ncas.authn.password-encoder.type=DEFAULT\n// after\ncas.authn.password-encoder.type=BCRYPT\ncas.authn.password-encoder.encoding=UTF-8","handlingStrategy":"try-catch","validationCode":"// verify encoder compatibility with stored hash format\nif (!storedPassword.matches(passwordEncoder.getPattern())) {\n  throw new IllegalStateException(\"stored password format not supported by encoder\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  return cloudDirectoryHandler.authenticate(credential);\n} catch (FailedLoginException e) {\n  LOGGER.warn(\"Bad password for [{}] against Cloud Directory\", credential.getUsername());\n  return AuthenticationHandlerResult.badPassword(credential);\n}","preventionTips":["Match cas.authn.password-encoder.type to the hashing scheme used when writing passwords to Cloud Directory.","Test with a known-good credential pair after any encoder or storage change.","Normalize stored values (no stray whitespace/prefixes) when provisioning users.","Log the encoder type alongside failures to speed diagnosis of mismatch issues."],"tags":["aws","cloud-directory","authentication","bad-password"],"backgroundTag":"invalid-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}