flowable/flowable-engine · error · BadCredentialsException

Authentication failed for this username and password

Error message

Authentication failed for this username and password

What it means

BasicAuthenticationProvider authenticates REST API requests using username/password from HTTP Basic auth against the Flowable identity service. When the authentication manager cannot validate the presented credentials, it throws BadCredentialsException with this generic message, deliberately not revealing whether the username or password was wrong.

Solutions

1. Verify the username and password by querying the identity store or logging in via the UI.
2. Check the configured AuthenticationProvider chain — if using LDAP, ensure ldapAuthenticationProvider is registered and reachable.
3. Confirm the client is sending a correct Base64-encoded Basic auth header for the right realm/engine.
4. Reset the user's password via identityService.setUserPassword or your user management UI.

Example fix

// before
curl -u admin:wronpass http://localhost:8080/flowable-rest/service/repository/process-definitions
// after
curl -u admin:test http://localhost:8080/flowable-rest/service/repository/process-definitions

long count = identityService.createUserQuery().userId(username).count();
if (count == 0) { throw new IllegalStateException("Unknown REST user"); }

try { restCall(); } catch (BadCredentialsException e) { // re-prompt or refresh credentials before retrying
}

When it happens

Trigger: Any REST call with an Authorization: Basic header whose decoded username/password combination fails authentication — unknown user, wrong password, or disabled user in the identity store.

Common situations: Stale or mistyped credentials in REST client config, users authenticated against an external directory not wired into the Flowable authentication provider, password changed/expired, or Basic auth header missing/garbled so the resolver yields wrong values.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication failed for this username and password
• A group or a user is required to create an identity link.
• A group or a user is required to create an identity link.
• Authentication failed for this username and password
• Comment text is required.

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/757ca13eda37cab6. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-rest/src/main/java/org/flowable/rest/security/BasicAuthenticationProvider.java:65

        String password = authentication.getCredentials().toString();

        boolean authenticated = idmIdentityService.checkPassword(userId, password);
        if (authenticated) {
            
            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>(1);
            if (isVerifyRestApiPrivilege()) {
                List<Privilege> privileges = idmIdentityService.createPrivilegeQuery().userId(userId).list();
                for (Privilege privilege : privileges) {
                    grantedAuthorities.add(new SimpleGrantedAuthority(privilege.getName()));
                }
            } else {
                // Always add the role when it's not verified: this makes the config easier (i.e. user needs to have it)
                grantedAuthorities.add(new SimpleGrantedAuthority(SecurityConstants.PRIVILEGE_ACCESS_REST_API));
            }
            
            return new UsernamePasswordAuthenticationToken(userId, password, grantedAuthorities);
        } else {
            throw new BadCredentialsException("Authentication failed for this username and password");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }

    public boolean isVerifyRestApiPrivilege() {
        return verifyRestApiPrivilege;
    }

    public void setVerifyRestApiPrivilege(boolean verifyRestApiPrivilege) {
        this.verifyRestApiPrivilege = verifyRestApiPrivilege;
    }
    
}

View on GitHub (pinned to d6d39ce1c6)