theonedev/onedev · error · UnknownAccountException

Invalid credentials

Error message

Invalid credentials

What it means

When neither an email-matched nor name-matched user exists and no external authenticator can claim the identity, OneDev has no way to authenticate the principal and throws UnknownAccountException('Invalid credentials'). Despite the message wording, it means the supplied user name/email does not map to any locally known account with usable credentials.

Source

Thrown at server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java:195

						var authenticated = authenticator.authenticate((UsernamePasswordToken) token);
						var emailAddressValue = authenticated.getEmail();
						if (emailAddressValue != null) {
							var emailAddress = emailAddressService.findByValue(emailAddressValue);
							if (emailAddress != null) {								
								if (!emailAddress.isVerified()) {
									emailAddressService.delete(emailAddress);
									return newUser(userName, authenticated, authenticator.getDefaultGroup());
								} else {
									throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" already used by another account"), emailAddressValue));
								}
							} else {
								return newUser(userName, authenticated, authenticator.getDefaultGroup());
							}
						} else {
							return newUser(userName, authenticated, authenticator.getDefaultGroup());
						}
					} else {
						throw new UnknownAccountException(_T("Invalid credentials"));
					}
				}
			} catch (Exception e) {
				if (e instanceof AuthenticationException) {
					logger.debug("Authentication not passed", e);
					throw ExceptionUtils.unchecked(e);
				} else {
					logger.error("Error authenticating user", e);
					throw new AuthenticationException(_T("Error authenticating user"), e);
				}
			}
		});
	}

	public Object writeReplace() throws ObjectStreamException {
		return new ManagedSerializedForm(AuthenticatingService.class);
	}

View on GitHub (pinned to d44925c47c)

Solutions

  1. Verify the username/email is correct and the account exists in Administration -> Users.
  2. If the user should exist, create the account or configure the external password authenticator so unknown identities can be provisioned.
  3. For external-auth deployments, log in via the SSO/LDAP flow instead of assuming local password auth.
  4. Check that you are using the right login field (username vs verified email).

Example fix

// before
curl -u jdoe:pass https://onedev.example.com/api/projects  # user 'jdoe' does not exist
// after (admin creates user 'jdoe' or configures LDAP authenticator)
curl -u jdoe:pass https://onedev.example.com/api/projects
Defensive patterns

Strategy: validation

Validate before calling

const user = await findUserByNameOrVerifiedEmail(identifier);
if (user == null && authenticator == null) {
  throw new Error('Unknown account: create the user or configure an external authenticator first');
}

Type guard

function isKnownPrincipal(idOrEmail, userService) {
  return userService.findByName(idOrEmail) != null || userService.findByVerifiedEmailAddress(idOrEmail) != null;
}

Try / catch

try {
  authenticate(principal, password);
} catch (UnknownAccountException e) {
  logger.warn("No local account for principal; check username or admin setup");
}

Prevention

When it happens

Trigger: Username/password login where userService.findByVerifiedEmailAddress and findByName both return null and settingService.getAuthenticator() is null (no external authenticator to create the user).

Common situations: Typo in the username; login with an email that is not registered; SSO/LDAP users attempting password login before the external authenticator is configured; account removed from OneDev while client credentials persist.

Understand the failure class

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/6800c824fd6367dd. Report an issue: GitHub.