nextcloud/all-in-one · error · InvalidSettingConfigurationException

The entered current password is not correct.

Error message

The entered current password is not correct.

What it means

Second check in ConfigurationManager::changeMasterPassword(): hash_equals() compares the submitted current password against the stored 'password' value of the AIO config; a mismatch (constant-time string comparison) throws InvalidSettingConfigurationException → HTTP 422. The stored password is the mastercontainer login password set at first AIO login or the last successful change, and it is kept as a plain string in the mastercontainer's config.json volume.

Source

Thrown at php/src/Data/ConfigurationManager.php:810

        $this->startTransaction();
        $this->borgBackupHostLocation = $location;
        $this->borgRemoteRepo = $repo;
        $this->borgRestorePassword = $password;
        $this->instanceRestoreAttempt = true;
        $this->commitTransaction();
    }

    /**
     * @throws InvalidSettingConfigurationException
     */
    public function changeMasterPassword(string $currentPassword, string $newPassword) : void {
        if ($currentPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter your current password.");
        }

        if (!hash_equals($this->password, $currentPassword)) {
            throw new InvalidSettingConfigurationException("The entered current password is not correct.");
        }

        if ($newPassword === '') {
            throw new InvalidSettingConfigurationException("Please enter a new password.");
        }

        if (strlen($newPassword) < 24) {
            throw new InvalidSettingConfigurationException("New passwords must be >= 24 digits.");
        }

        if (!preg_match("#^[a-zA-Z0-9 ]+$#", $newPassword)) {
            throw new InvalidSettingConfigurationException('Not allowed characters in the new password.');
        }

        // All checks pass so set the password
        $this->set('password', $newPassword);
    }

View on GitHub (pinned to 6b788eec5e)

Solutions

1. Use the AIO web-interface login password, not the Nextcloud user password
2. Recover the initial password from the first-startup output ('sudo docker logs nextcloud-aio-mastercontainer' prints it once) or read the 'password' entry from the mastercontainer's config.json in the docker-aio-config volume — the comparison is a plain string compare, so the stored value is the password
3. Re-check for typos, keyboard layout issues and pasted whitespace before concluding the password is lost

Example fix

// before
current-master-password = '<nextcloud user password>'
// after
current-master-password = '<AIO interface login password>'

// No meaningful client-side pre-check exists: the comparison value is the
// stored mastercontainer password. Require fresh authentication instead and
// rely on catching the mismatch.

function isInvalidSettingConfigurationException(\Throwable $e): bool {
    return $e instanceof \AIO\Data\InvalidSettingConfigurationException;
}

use AIO\Data\InvalidSettingConfigurationException;

try {
    $configurationManager->changeMasterPassword($currentPassword, $newPassword);
} catch (InvalidSettingConfigurationException $e) {
    // wrong current password: show the message, keep the session,
    // and rate-limit repeated attempts like any login flow
    $formErrors[] = $e->getMessage();
}

When it happens

Trigger: Typing a wrong or outdated AIO password; using the Nextcloud user-account password instead of the AIO interface password; pasting with stray whitespace or an autocorrected value; the password having been changed earlier and the old one reused.

Common situations: Confusing the AIO mastercontainer password with the Nextcloud login; a forgotten initial password (printed once at first mastercontainer start); shared installs where another admin changed the password.

Related errors

• Please enter the password!
• Please enter your current password.
• Please enter a new password.
• Domain must contain at least one dot!
• Domain must not contain slashes!

AI-assisted analysis of nextcloud/all-in-one@6b788eec5e (2026-08-21). Data as JSON: /api/errors/c533f570fb476853. Report an issue: GitHub.