What causes "Server rejected request: wrong username or password" in arduino/Arduino?

Verify the credentials by logging in interactively (e.g. Windows logon or another NTLM client) to confirm they are valid.

arduino/Arduino · error · Exception

Server rejected request: wrong username or password

Error message

Server rejected request: wrong username or password

What it means

During the second leg of the NTLM handshake, after urllib3 sends the NTLM AUTHENTICATE message with the user's credentials, ntlmpool._new_conn checks the final response status. A 401 means the server rejected the credentials, so the pool raises this Exception indicating wrong username or password.

Source

Thrown at arduino-core/src/processing/app/i18n/python/requests/packages/urllib3/contrib/ntlmpool.py:103

        # Send authentication message
        ServerChallenge, NegotiateFlags = \
            ntlm.parse_NTLM_CHALLENGE_MESSAGE(auth_header_value)
        auth_msg = ntlm.create_NTLM_AUTHENTICATE_MESSAGE(ServerChallenge,
                                                         self.user,
                                                         self.domain,
                                                         self.pw,
                                                         NegotiateFlags)
        headers[req_header] = 'NTLM %s' % auth_msg
        log.debug('Request headers: %s' % headers)
        conn.request('GET', self.authurl, None, headers)
        res = conn.getresponse()
        log.debug('Response status: %s %s' % (res.status, res.reason))
        log.debug('Response headers: %s' % dict(res.getheaders()))
        log.debug('Response data: %s [...]' % res.read()[:100])
        if res.status != 200:
            if res.status == 401:
                raise Exception('Server rejected request: wrong '
                                'username or password')
            raise Exception('Wrong server response: %s %s' %
                            (res.status, res.reason))

        res.fp = None
        log.debug('Connection established')
        return conn

    def urlopen(self, method, url, body=None, headers=None, retries=3,
                redirect=True, assert_same_host=True):
        if headers is None:
            headers = {}
        headers['Connection'] = 'Keep-Alive'
        return super(NTLMConnectionPool, self).urlopen(method, url, body,
                                                       headers, retries,
                                                       redirect,
                                                       assert_same_host)

View on GitHub (pinned to a0df6e0e83)

Solutions

Verify the credentials by logging in interactively (e.g. Windows logon or another NTLM client) to confirm they are valid.
Check the domain qualifier format: try 'DOMAIN\\username' and 'username@domain' forms — some servers require one or the other.
Confirm the account is not expired/locked and that it is allowed on the target server (AD account status).
Recreate the pool with corrected credentials — NTLMConnectionPool caches connections, so rebuild the pool rather than mutating it.

Example fix

// before
pool = NTLMConnectionPool(host, username='alice', password='old-pw')
// after
pool = NTLMConnectionPool(host, username='CORP\\alice', password='new-correct-pw')

Defensive patterns

Strategy: try-catch

Validate before calling

def validate_ntlm_credentials(username, password):
    if not username or not password:
        raise ValueError('NTLM username and password are required')
    if '\\' not in username and '@' not in username:
        raise ValueError("Use 'DOMAIN\\user' or 'user@domain' format for NTLM credentials")

Type guard

def looks_like_domain_account(username):
    return isinstance(username, str) and ('\\' in username or '@' in username)

Try / catch

try:
    resp = ntlm_pool.urlopen('GET', path)
except Exception as e:
    if 'wrong username or password' in str(e):
        log.error('NTLM credentials rejected; refresh username/password/domain')
        raise AuthFailure(str(e)) from None
    raise

Prevention

Store NTLM credentials in a secret manager and refresh them on password rotation.
Test credentials interactively or with curl --ntlm before deploying.
Use the DOMAIN\\user or user@domain form consistently for your environment.
Lock guard rails: stop retrying after one 401 to avoid account lockout.

When it happens

Trigger: Any request through NTLMConnectionPool where the username/password (or Windows domain) supplied to the pool is wrong, expired, or locked out — the server responds 401 after the NTLM authenticate message.

Common situations: Password recently changed or expired; wrong domain format (DOMAIN\\user vs user@domain); account locked by failed attempts; service account disabled; pointing corporate-credential pools at a test server with different accounts.

Related errors

AI-assisted analysis of arduino/Arduino@a0df6e0e83 (2026-09-06). Data as JSON: /api/errors/861d7d68ed622639. Report an issue: GitHub.