pentaho/pentaho-kettle · critical · KettleException

SalesforceInput.Error.InvalidUsernameOrPassword

SalesforceInput.Error.InvalidUsernameOrPassword

Error message

SalesforceInput.Error.InvalidUsernameOrPassword

What it means

connect() catches a Salesforce ConnectionException whose exception code is in the auth-failure family (INVALID_LOGIN, INVALID_CLIENT, PASSWORD_LOCKOUT, TRIAL_EXPIRED, etc.) and rethrows it as this KettleException. It means the username/password/security-token credentials were rejected by the Salesforce login endpoint.

Solutions

  1. Verify the username, password, and appended security token in the Salesforce step connection settings.
  2. If logging in from a new IP, reset/obtain the security token in Salesforce Setup (My Personal Information > Reset Security Token).
  3. Check the exact upstream code (e.g. PASSWORD_LOCKOUT) — wait out a lockout or have an admin unlock the user.
  4. Confirm the login URL matches the environment (test.salesforce.com vs login.salesforce.com).
  5. Check the org's Login IP Ranges / Login Hours / restricted-domain policies with the Salesforce admin.

Example fix

// before
conn.setUsername("user@company.com");
conn.setPassword("p@ss"); // token missing after password change
// after
conn.setUsername("user@company.com");
conn.setPassword("p@ssTOKEN"); // password + current security token
Defensive patterns

Strategy: try-catch

Validate before calling

if (username == null || password == null || !loginUrl.startsWith("https://")) {
  throw new IllegalArgumentException("Incomplete Salesforce credentials or URL");
}

Try / catch

try {
  conn.connect();
} catch (KettleException e) {
  if (e.getMessage().contains("InvalidUsernameOrPassword")) {
    // treat as auth failure: refresh token/password, do not blind-retry
    throw new AuthenticationException(e);
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling connect() (directly or via getConnection/getFields/getModuleFields) with a wrong username, wrong password, missing/incorrect security token, expired trial, locked-out password, or a client version Salesforce no longer accepts.

Common situations: Password changed without updating the step; user logging in from a new IP requires adding a security token; org locked or login restricted by time/domain/IP policies; sandbox credentials used against production URL or vice versa.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/6f92092f1e5dde24. Report an issue: GitHub.

Appendix: source

Thrown at plugins/salesforce/core/src/main/java/org/pentaho/di/trans/steps/salesforce/SalesforceConnection.java:373

      this.serverTimestamp = pConnection.getServerTimestamp().getTimestamp().getTime();
      if ( log.isDebug() ) {
        BaseMessages.getString( PKG, "SalesforceInput.Log.ServerTimestamp", getServerTimestamp() );
      }

      if ( log.isDetailed() ) {
        log.logDetailed( BaseMessages.getString( PKG, "SalesforceInput.Log.Connected" ) );
      }

    } catch ( LoginFault ex ) {
      // The LoginFault derives from AxisFault
      ExceptionCode exCode = ex.getExceptionCode();
      if ( exCode == ExceptionCode.FUNCTIONALITY_NOT_ENABLED
        || exCode == ExceptionCode.INVALID_CLIENT || exCode == ExceptionCode.INVALID_LOGIN
        || exCode == ExceptionCode.LOGIN_DURING_RESTRICTED_DOMAIN
        || exCode == ExceptionCode.LOGIN_DURING_RESTRICTED_TIME || exCode == ExceptionCode.ORG_LOCKED
        || exCode == ExceptionCode.PASSWORD_LOCKOUT || exCode == ExceptionCode.SERVER_UNAVAILABLE
        || exCode == ExceptionCode.TRIAL_EXPIRED || exCode == ExceptionCode.UNSUPPORTED_CLIENT ) {
        throw new KettleException( BaseMessages.getString( PKG, "SalesforceInput.Error.InvalidUsernameOrPassword" ) );
      }
      throw new KettleException( BaseMessages.getString( PKG, "SalesforceInput.Error.Connection" ), ex );
    } catch ( Exception e ) {
      throw new KettleException( BaseMessages.getString( PKG, "SalesforceInput.Error.Connection" ), e );
    }
  }

  public void query( boolean specifyQuery ) throws KettleException {

    if ( getBinding() == null ) {
      throw new KettleException( BaseMessages.getString( PKG, "SalesforceInput.Exception.CanNotGetBiding" ) );
    }

    try {
      if ( !specifyQuery ) {
        // check if we can query this Object
        DescribeSObjectResult describeSObjectResult = getBinding().describeSObject( getModule() );
        if ( describeSObjectResult == null ) {

View on GitHub (pinned to f3058517a1)