phacility/phabricator · warning · Exception

Username and password are required!

Error message

Username and password are required!

What it means

Thrown from PhabricatorLDAPAuthProvider's login processing when the submitted login form has no username or no password (the code paths that populate both were not taken, so it raises this Exception instead of attempting an LDAP bind with empty credentials). It is a plain Exception thrown while building the login response, before any LDAP communication happens.

Source

Thrown at src/applications/auth/provider/PhabricatorLDAPAuthProvider.php:170

      return array($account, $response);
    }

    if ($request->isFormPost()) {
      try {
        if (strlen($username) && $has_password) {
          $adapter = $this->getAdapter();
          $adapter->setLoginUsername($username);
          $adapter->setLoginPassword($password);

          // TODO: This calls ldap_bind() eventually, which dumps cleartext
          // passwords to the error log. See note in PhutilLDAPAuthAdapter.
          // See T3351.

          DarkConsoleErrorLogPluginAPI::enableDiscardMode();
            $identifiers = $adapter->getAccountIdentifiers();
          DarkConsoleErrorLogPluginAPI::disableDiscardMode();
        } else {
          throw new Exception(pht('Username and password are required!'));
        }
      } catch (PhutilAuthCredentialException $ex) {
        $response = $controller->buildProviderPageResponse(
          $this,
          $this->renderLoginForm($request, 'login'));
        return array($account, $response);
      } catch (Exception $ex) {
        // TODO: Make this cleaner.
        throw $ex;
      }
    }

    $account = $this->newExternalAccountForIdentifiers($identifiers);

    return array($account, $response);
  }

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Fill in both the username and password fields and resubmit the form normally.
2. If driving Phabricator programmatically, stop using the LDAP form endpoint with raw POSTs — use Conduit API tokens or a real browser-level flow, and always send both fields if you must POST.
3. Check any customized login template (field names, required attributes) so both inputs actually reach the provider.
4. If it happens for real users, add client-side required-field validation on the LDAP login form to give feedback before submission.

// Check both fields before submitting/handling the LDAP login form
if (!strlen($username) || !strlen($password)) {
  // show 'username and password are required' inline on the form
  // instead of letting the provider throw
}

When it happens

Trigger: Submitting the LDAP login form with one or both fields empty; a custom client (API script, mobile app, or automated POST) hitting the LDAP login endpoint without both credentials; a form where JavaScript validation was bypassed or the field names do not match what the provider reads.

Common situations: Automated clients posting to the login endpoint with missing parameters; accessibility tools or password managers failing to fill one field; a customized login template that renamed or dropped an input; users submitting the form prematurely.

Related errors

• You must enter an LDAP username.
• You must enter an LDAP password.
• Two authentication providers use the same provider key ('%s'
• Authentication provider (of class "%s") is attempting to loa
• Your browser did not submit a "%s" cookie with client state

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/b2b4677774edc454. Report an issue: GitHub.