flowable/flowable-engine · error · BadCredentialsException

Authentication failed for this username and password

Error message

Authentication failed for this username and password

What it means

This Spring Security AuthenticationProvider validated the username/password pair against the IDM identity service and the credentials did not match an existing, enabled user. It throws Spring's BadCredentialsException, which the REST layer translates into a 401 response.

Solutions

1. Verify the username exists and is active in the Flowable IDM user tables (ACT_ID_USER)
2. Reset the password via the identity service/admin API and retry
3. Confirm the client is sending correct Basic auth header for the right environment
4. Check that the custom BasicAuthenticationProvider actually loads the user and compares passwords as expected (e.g. password encoder mismatch after upgrade)

Example fix

// before
curl -u admin:wrongpass http://host/flowable-cmmn-api/cmmn-server/repositories
// after
curl -u admin:admin http://host/flowable-cmmn-api/cmmn-server/repositories

User u = identityService.createUserQuery().userId(username).singleKeyword()==null ? null : identityService.createUserQuery().userId(username).singleResult();
if (u == null) { failFast("unknown user"); }

try {
    auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(name, password));
} catch (BadCredentialsException e) {
    throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid credentials");
}

When it happens

Trigger: POST/basic-auth to a CMMN REST endpoint with a username that does not exist, a wrong password, or a user whose password hash does not match after an IDM/user store change.

Common situations: Misconfigured REST API basic-auth credentials in clients; password changed or user deactivated in the Flowable IDM tables; environment where identity data was not seeded (users/groups missing); connecting with credentials valid in a different deployment.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication failed for this username and password
• Authentication failed for this username and password
• A group or a user is required to create an identity link.
• A group or a user is required to create an identity link.
• A group or a user is required to create an identity link.

AI-assisted analysis of flowable/flowable-engine@d6d39ce1c6 (2026-09-11). Data as JSON: /api/errors/27af3d4f73fe82b0. Report an issue: GitHub.

Appendix: source

Thrown at modules/flowable-cmmn-rest/src/main/java/org/flowable/cmmn/rest/security/BasicAuthenticationProvider.java:51

    @Autowired
    @Lazy
    private IdmIdentityService identityService;

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String name = authentication.getName();
        String password = authentication.getCredentials().toString();

        boolean authenticated = identityService.checkPassword(name, password);
        if (authenticated) {
            List<Group> groups = identityService.createGroupQuery().groupMember(name).list();
            Collection<GrantedAuthority> grantedAuthorities = new ArrayList<>();
            for (Group group : groups) {
                grantedAuthorities.add(new SimpleGrantedAuthority(group.getId()));
            }
            return new UsernamePasswordAuthenticationToken(name, password, grantedAuthorities);
        } else {
            throw new BadCredentialsException("Authentication failed for this username and password");
        }
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return authentication.equals(UsernamePasswordAuthenticationToken.class);
    }
}

View on GitHub (pinned to d6d39ce1c6)