flowable/flowable-engine · error · BadCredentialsException

Authentication failed for this username and password

Error message

Authentication failed for this username and password

What it means

FlowableAuthenticationProvider's additionalAuthenticationChecks delegates password validation to the Flowable IDM IdentityService.checkPassword. If the IDM service says the username/password pair is not valid, it throws Spring Security's BadCredentialsException with this message. This mirrors Spring Security's standard bad-credentials contract.

Solutions

1. Verify the credentials against the IDM user store (ACT_ID_USER table) and re-enter the correct password
2. Confirm the IDM user's password hash matches the configured password encoder (e.g. re-hash after encoder change)
3. Ensure user provisioning code sets a password in the IDM identity service
4. Check for case sensitivity or realm/tenant mismatch between the login form and IDM data

Example fix

// before: user created without password
identityService.newUser("admin");
// after
User u = identityService.newUser("admin");
u.setPassword("secret");
identityService.saveUser(u);

boolean ok = idmIdentityService.checkPassword(username, rawPassword);
if (!ok) { throw new BadCredentialsException("Bad credentials"); }

try { authManager.authenticate(token); } catch (BadCredentialsException e) { /* return 401 / show 'invalid username or password' without leaking which part failed */ }

When it happens

Trigger: AuthenticationManager.authenticate(UsernamePasswordAuthenticationToken) is invoked with credentials that fail idmIdentityService.checkPassword for the resolved UserDetails.

Common situations: Typo in password or username; user exists in Spring's UserDetailsService but the IDM identity store has a different/no password; password hashing mismatch between IDM config and stored hash; user provisioned without a password.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• user ( ) could not be found
• Authentication failed for this username and password
• Authentication failed for this username and password
• Authentication failed for this username and password
• Could not create InitialDirContext for LDAP connection:

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/dab1f520438a9fc8. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-spring-security/src/main/java/org/flowable/spring/security/FlowableAuthenticationProvider.java:46

 */
public class FlowableAuthenticationProvider extends AbstractUserDetailsAuthenticationProvider {

    protected final IdmIdentityService idmIdentityService;
    protected final UserDetailsService userDetailsService;

    public FlowableAuthenticationProvider(IdmIdentityService idmIdentityService, UserDetailsService userDetailsService) {
        this.idmIdentityService = idmIdentityService;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void additionalAuthenticationChecks(UserDetails userDetails, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        String name = userDetails.getUsername();
        String password = authentication.getCredentials().toString();

        boolean authenticated = idmIdentityService.checkPassword(name, password);
        if (!authenticated) {
            throw new BadCredentialsException("Authentication failed for this username and password");
        }
    }

    @Override
    protected UserDetails retrieveUser(String username, UsernamePasswordAuthenticationToken authentication) throws AuthenticationException {
        return userDetailsService.loadUserByUsername(username);
    }
}

View on GitHub (pinned to d6d39ce1c6)