theonedev/onedev · error · AuthenticationException

No external password authenticator to authenticate user "{0}

Error message

No external password authenticator to authenticate user "{0}"

What it means

The local user has a null password, meaning its credentials are managed by an external password authenticator. If settingService.getAuthenticator() returns null (no external authenticator configured), OneDev cannot verify the credentials and throws this AuthenticationException instead of falling back to local password checks.

Source

Thrown at server-core/src/main/java/io/onedev/server/security/DefaultAuthenticatingService.java:169

							if (emailAddressValue != null) {
								var emailAddress = emailAddressService.findByValue(emailAddressValue);
								if (emailAddress != null) {
									if (emailAddress.getOwner().equals(user) || !emailAddress.isVerified()) {
										updateUser(user, authenticated, emailAddress, authenticator.getDefaultGroup());
										return user;
									} else {
										throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" already used by another account"), emailAddressValue));
									}
								} else {
									updateUser(user, authenticated, null, authenticator.getDefaultGroup());
									return user;
								}
							} else {
								updateUser(user, authenticated, null, authenticator.getDefaultGroup());
								return user;																
							}
						} else {
							throw new AuthenticationException(MessageFormat.format(_T("No external password authenticator to authenticate user \"{0}\""), userName));
						}
					} else {
						return user;
					}
				} else {
					var authenticator = settingService.getAuthenticator();
					if (authenticator != null) {
						var authenticated = authenticator.authenticate((UsernamePasswordToken) token);
						var emailAddressValue = authenticated.getEmail();
						if (emailAddressValue != null) {
							var emailAddress = emailAddressService.findByValue(emailAddressValue);
							if (emailAddress != null) {								
								if (!emailAddress.isVerified()) {
									emailAddressService.delete(emailAddress);
									return newUser(userName, authenticated, authenticator.getDefaultGroup());
								} else {
									throw new AuthenticationException(MessageFormat.format(_T("Email address \"{0}\" already used by another account"), emailAddressValue));
								}

View on GitHub (pinned to d44925c47c)

Solutions

Configure the external password authenticator under Server Administration -> Authenticators matching the original setup.
If external auth is no longer wanted, set a local password for the user(s) so getPassword() != null.
Check server logs/config for authenticator settings that failed to load after migration.
As a stopgap, an admin can reset the user's password to create a local credential.

Example fix

// before: user imported with null password, no authenticator configured -> error
// after (admin): Administration -> Authenticators -> add LDAP authenticator,
// or set the user's password locally so login uses internal password check

Defensive patterns

Strategy: validation

Validate before calling

// Check authenticator presence before password login of externally-managed users:
if (settingService.getAuthenticator() == null && user.getPassword() == null) {
  configureExternalAuthenticatorOrSetLocalPassword();
}

Type guard

function canUsePasswordAuth(user, settings) { return user.password != null || settings.authenticator != null; }

Try / catch

try {
  authenticate(userName, password);
} catch (AuthenticationException e) {
  if (e.getMessage().contains("No external password authenticator")) {
    alertAdmin("Configure external authenticator in Administration -> Authenticators");
  }
}

Prevention

Back up and restore authenticator settings together with the rest of server config.
After migration, smoke-test login for an externally-managed user.
Avoid importing users with null passwords unless an external authenticator will be configured.

When it happens

Trigger: Password login for a user whose User.getPassword() is null while no external authenticator is configured in Administration -> Authenticators (or the authenticator setting failed to load).

Common situations: Server was migrated/restored from a backup that had an external authenticator (LDAP, SSO) configured, but the new instance lacks the authenticator config; or users were imported with null passwords from an external source.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/1d6b2ff5a2503c0d. Report an issue: GitHub.