n8n-io/n8n · error · AuthError

401

401

Error message

Reset your password to gain access to the instance.

What it means

Email auth handler throws AuthError('Reset your password to gain access to the instance.') (401) when a user's password did not match, but the account has an LDAP authIdentity AND LDAP login is currently disabled. This guides the former-LDAP user to reset their password since LDAP is off.

Source

Thrown at packages/cli/src/auth/handlers/email.auth-handler.ts:39

	) {}

	async handleLogin(email: string, password: string): Promise<User | undefined> {
		const user = await this.userRepository.findOne({
			where: { email },
			relations: ['authIdentities', 'role'],
		});

		if (user?.password && (await this.passwordUtility.compare(password, user.password))) {
			return user;
		}

		// At this point if the user has a LDAP ID, means it was previously an LDAP user,
		// so suggest to reset the password to gain access to the instance.
		const ldapIdentity = user?.authIdentities?.find((i) => i.providerType === 'ldap');
		if (user && ldapIdentity && !this.globalConfig.sso.ldap.loginEnabled) {
			this.eventService.emit('login-failed-due-to-ldap-disabled', { userId: user.id });

			throw new AuthError('Reset your password to gain access to the instance.');
		}

		return undefined;
	}
}

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Use the password reset flow to establish a local password, then log in.
2. If LDAP should still work, re-enable it (N8N_SSO_LDAP_LOGIN_ENABLED=true) and configure the LDAP server.
3. Admin can clear the LDAP authIdentity for the user if they should be a pure local user.

Example fix

n/a

n/a (authIdentity presence and LDAP flag are server-side)

function isLdapResetPrompt(error: unknown): boolean {
  return error instanceof Error && error.message.startsWith('Reset your password');
}

try {
  const user = await emailAuthHandler.authenticate(email, password);
} catch (e) {
  if (isLdapResetPrompt(e)) { /* show 'reset password' flow */ }
  else throw e;
}

When it happens

Trigger: Email/password login where bcrypt compare failed, the user has a providerType==='ldap' authIdentity, and globalConfig.sso.ldap.loginEnabled is false. Emits 'login-failed-due-to-ldap-disabled' telemetry before throwing.

Common situations: LDAP integration was disabled but former LDAP users never set a local password; user is typing their LDAP password against the local login form after SSO was turned off.

Related errors

• forgotPassword.ldapUserPasswordResetUnavailable
• Login is handled by ${currentAuthenticationMethod}. Please c
• 401
• If MFA enabled, mfaCode is required.
• Invalid MFA token.

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/1bd6f34a3f131675. Report an issue: GitHub.