apolloconfig/apollo · error · BadCredentialsException

Empty Password

Error message

Empty Password

What it means

Thrown by ApolloLdapAuthenticationProvider.authenticate() when the password (credentials) extracted from the authentication token has zero length. Checked via StringUtils.hasLength, immediately after the username check. BadCredentialsException → HTTP 401. Message key 'AbstractLdapAuthenticationProvider.emptyPassword', default 'Empty Password'.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/spi/ldap/ApolloLdapAuthenticationProvider.java:82

  @Override
  public Authentication authenticate(Authentication authentication) throws AuthenticationException {
    Assert.isInstanceOf(UsernamePasswordAuthenticationToken.class, authentication,
        this.messages.getMessage("LdapAuthenticationProvider.onlySupports",
            "Only UsernamePasswordAuthenticationToken is supported"));
    UsernamePasswordAuthenticationToken userToken =
        (UsernamePasswordAuthenticationToken) authentication;
    String username = userToken.getName();
    String password = (String) authentication.getCredentials();
    if (this.logger.isDebugEnabled()) {
      this.logger.debug("Processing authentication request for user: " + username);
    }

    if (!StringUtils.hasLength(username)) {
      throw new BadCredentialsException(
          this.messages.getMessage("LdapAuthenticationProvider.emptyUsername", "Empty Username"));
    }
    if (!StringUtils.hasLength(password)) {
      throw new BadCredentialsException(this.messages
          .getMessage("AbstractLdapAuthenticationProvider.emptyPassword", "Empty Password"));
    }
    Assert.notNull(password, "Null password was supplied in authentication token");
    DirContextOperations userData = this.doAuthentication(userToken);
    String loginId = userData.getStringAttribute(properties.getMapping().getLoginId());
    UserDetails user = this.userDetailsContextMapper.mapUserFromContext(userData, loginId,
        this.loadUserAuthorities(userData, loginId, (String) authentication.getCredentials()));
    return this.createSuccessfulAuthentication(userToken, user);
  }
}

View on GitHub (pinned to d95fc18d11)

Solutions

1. Provide a non-empty password in the login form or authentication request.
2. Add client-side validation to require a non-empty password before submission.
3. For API clients, ensure the password portion of the Authorization header is populated.

Example fix

// before — login submitted with empty password
// after — frontend validation
if (!password) { showFieldError('password', 'Password is required'); return; }

if (!StringUtils.hasLength(password)) {
    return ResponseEntity.badRequest().body("Password is required");
}

static boolean hasNonEmptyPassword(String password) {
    return password != null && !password.isEmpty();
}

try {
    authenticationManager.authenticate(
        new UsernamePasswordAuthenticationToken(username, password));
} catch (BadCredentialsException e) {
    if (e.getMessage().contains("Empty Password")) {
        return ResponseEntity.status(401).body("Password is required");
    }
    throw e;
}

When it happens

Trigger: An authentication request to the LDAP-backed Apollo portal login where the password is empty or null. The credential is extracted as (String) authentication.getCredentials(); if it has no length, BadCredentialsException is thrown before any LDAP bind is attempted.

Common situations: Login form submitted with an empty password field. API client omits or sends empty password in Basic Auth. User mistypes and submits without a password. Frontend password field validation is missing or bypassed.

Related errors

• Empty Username
• User {username} not found in directory.
• Token is Illegal
• Current user not found
• operator should not be null or empty

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/359e06cc03ea735e. Report an issue: GitHub.