mattermost-community/focalboard · error

invalid username or password

Error message

invalid username or password

What it means

Login returns this when the username lookup fails, wrapped over the store error. The message is deliberately generic to avoid leaking which usernames exist. The first of three failure paths that share the same message.

Source

Thrown at server/app/auth.go:102

		user, err = a.store.GetUserByUsername(username)
		if err != nil && !model.IsErrNotFound(err) {
			a.metrics.IncrementLoginFailCount(1)
			return "", errors.Wrap(err, "invalid username or password")
		}
	}

	if user == nil && email != "" {
		var err error
		user, err = a.store.GetUserByEmail(email)
		if err != nil && model.IsErrNotFound(err) {
			a.metrics.IncrementLoginFailCount(1)
			return "", errors.Wrap(err, "invalid username or password")
		}
	}

	if user == nil {
		a.metrics.IncrementLoginFailCount(1)
		return "", errors.New("invalid username or password")
	}

	if !auth.ComparePassword(user.Password, password) {
		a.metrics.IncrementLoginFailCount(1)
		a.logger.Debug("Invalid password for user", mlog.String("userID", user.ID))
		return "", errors.New("invalid username or password")
	}

	authService := user.AuthService
	if authService == "" {
		authService = "native"
	}

	session := model.Session{
		ID:          utils.NewID(utils.IDTypeSession),
		Token:       utils.NewID(utils.IDTypeToken),
		UserID:      user.ID,
		AuthService: authService,

View on GitHub (pinned to a84bbb65e3)

Solutions

1. Verify the username/email exists and is spelled correctly
2. Confirm the account exists in the configured datastore
3. Check the app is pointed at the intended database (env/config)

if username == "" || password == "" {
    return errors.New("username and password are required")
}

token, err := a.Login(id, password, mfaToken)
if err != nil {
    if strings.Contains(err.Error(), "invalid username or password") {
        return ErrBadCredentials // surface neutral auth failure to client
    }
    return errors.Wrap(err, "login failed")
}

When it happens

Trigger: a.Login(id, password, mfaToken) where store.GetUserByEmail/ByUsername returns an unknown-user error for the given login identifier.

Common situations: Typoed username/email; user account removed or deactivated; wrong email domain; test fixtures pointing at a fresh database with no users.

Related errors

• no user ID
• No User IDs
• The username already exists
• The email already exists
• Unable to create the new user

AI-assisted analysis of mattermost-community/focalboard@a84bbb65e3 (2026-08-30). Data as JSON: /api/errors/d6f0c8407b9cda0f. Report an issue: GitHub.