What causes "Authentication failed for this username and password" in flowable/flowable-engine?

Verify the username and password used in the Basic auth header against the configured user store

flowable/flowable-engine · error · BadCredentialsException

Authentication failed for this username and password

Error message

Authentication failed for this username and password

What it means

Spring Security BadCredentialsException thrown by the event-registry REST app's BasicAuthenticationProvider when the user exists but the password (or user validation) fails during HTTP Basic authentication. It deliberately gives no detail about which of username/password was wrong.

Solutions

Verify the username and password used in the Basic auth header against the configured user store
Re-encode the header correctly: Base64 of 'username:password' sent as 'Authorization: Basic ...'
Check server-side user configuration (flowable.rest.app.authentication-mode, LDAP properties) for changes
Confirm the account is not locked/disabled and the credentials file was reloaded after changes

Example fix

// before
curl -u admin:wrongpass http://localhost:8080/flowable-event-registry/rest/... 
// after
curl -u admin:secret http://localhost:8080/flowable-event-registry/rest/...

Defensive patterns

Strategy: try-catch

Try / catch

try {
    ResponseEntity<String> resp = rest.exchange(url, HttpMethod.GET, new HttpEntity<>(headers), String.class);
} catch (HttpClientErrorException.Unauthorized e) {
    logger.error("Event registry REST auth failed; check username/password");
    throw new RestAuthenticationException(e);
}

Prevention

Store REST credentials in a secrets manager and rotate with the server-side config
Test credentials with a cheap endpoint before critical calls
Verify the Authorization header is 'Basic ' + Base64(username:password)
Check that the account is enabled and the auth provider (in-memory/LDAP) config matches the server

When it happens

Trigger: An HTTP request to the event-registry REST API carries a Basic auth header whose username/password do not authenticate: additionalAuthenticationChecks or the user check returns false, so authenticate() throws instead of returning the UsernamePasswordAuthenticationToken.

Common situations: Wrong credentials in the REST client or environment; password changed or expired on the server; credentials encoded with the wrong scheme in the Authorization header; misconfigured users file/LDAP.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/f120141d297cbc8c. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-event-registry-rest/src/main/java/org/flowable/eventregistry/rest/security/BasicAuthenticationProvider.java:51

    @Autowired
    @Lazy
    private IdmIdentityService identityService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        boolean authenticated = identityService.checkPassword(name, password);
        if (authenticated) {
            List<Group> groups = identityService.createGroupQuery().groupMember(name).list();
            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
            for (Group group : groups) {
                grantedAuthorities.add(new SimpleGrantedAuthority(group.getId()));
            }
            return new UsernamePasswordAuthenticationToken(name, password, grantedAuthorities);
        } else {
            throw new BadCredentialsException("Authentication failed for this username and password");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

View on GitHub (pinned to d6d39ce1c6)