What causes "Incorrect credentials" in theonedev/onedev?

Re-enter the password carefully (check caps lock and keyboard layout).

theonedev/onedev · warning · IncorrectCredentialsException

Incorrect credentials

Error message

Incorrect credentials

What it means

After locating the user's DN, OneDev attempts an LDAP 'simple' bind as that DN using the supplied password. If the server rejects the bind with AuthenticationException, the credentials are wrong and OneDev throws IncorrectCredentialsException('Incorrect credentials').

Source

Thrown at server-plugin/server-plugin-authenticator-ldap/src/main/java/io/onedev/server/plugin/authenticator/ldap/LdapAuthenticator.java:282

                		StringUtils.substringAfter(searchResult.getName(), "//"), "/"));
                
                ldapEnv.put(Context.PROVIDER_URL, builder.toString());
                logger.debug("Binding to referral ldap url '" + builder.toString() + "'...");
                referralCtx = new InitialDirContext(ldapEnv);
            }
            if (userDN.startsWith("ldap")) {
            	userDN = StringUtils.substringAfter(userDN, "//");
            	userDN = StringUtils.substringAfter(userDN, "/");
            }

            ldapEnv.put(Context.SECURITY_PRINCIPAL, userDN);
            ldapEnv.put(Context.SECURITY_CREDENTIALS, new String(token.getPassword()));
            DirContext userCtx = null;
            try {
                userCtx = new InitialDirContext(ldapEnv);
            } catch (AuthenticationException e) {
                logger.error("Unable to bind as '" + userDN + "'", e);
            	throw new IncorrectCredentialsException("Incorrect credentials");
            } finally {
                if (userCtx != null) {
                    try {
                        userCtx.close();
                    } catch (NamingException e) {
                    }
                }
            }
            
            DirContext effectiveCtxt = referralCtx != null? referralCtx: ctx;
            Attributes searchResultAttributes = searchResult.getAttributes();
            if (searchResultAttributes != null) {
                if (getUserFullNameAttribute() != null) {
                    Attribute attribute = searchResultAttributes.get(getUserFullNameAttribute());
                    if (attribute != null && attribute.get() != null)
                        fullName = (String) attribute.get();
                }

View on GitHub (pinned to d44925c47c)

Solutions

Re-enter the password carefully (check caps lock and keyboard layout).
Test the password directly with ldapwhoami -H ldaps://host -D 'userDN' -W to confirm it is a OneDev-independent problem.
Check the account status in the directory: unlocked, not expired, no 'must change password' flag.
If recently changed, retry after directory replication completes.

Example fix

// no code fix; server-side check:
// ldapwhoami -H ldaps://ldap.example.com -D 'cn=Jane Doe,ou=People,dc=example,dc=com' -W
// before: password "secret " (trailing space) -> after: "secret"

Defensive patterns

Strategy: try-catch

Try / catch

try {
    userCtx = new InitialDirContext(ldapEnv);
} catch (AuthenticationException e) {
    // prompt user to re-enter password; check AD account lock/expiry before retry
} catch (NamingException e) {
    // connectivity/server problem, distinguishable from bad credentials
}

Prevention

Avoid trimming/transforming passwords entered by users
Monitor AD for account lockout policies triggered by retries
Keep bind attempts rate-limited to avoid lockouts
Test user binds with ldapwhoami independently of OneDev

When it happens

Trigger: new InitialDirContext(ldapEnv) with SECURITY_PRINCIPAL=userDN and SECURITY_CREDENTIALS=entered password throws javax.naming.AuthenticationException — the password typed at login does not match the directory password for the resolved userDN.

Common situations: User mistyped or caps-locked the password; account locked/expired or must change password at next logon in AD; password stored with leading/trailing whitespace; directory replication lag after a recent password change.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/5fa1f7338322d88e. Report an issue: GitHub.