theonedev/onedev · info · ExplicitException

Unable to change password as you are authenticating via exte

Error message

Unable to change password as you are authenticating via external system

What it means

MyPasswordPage throws an ExplicitException when the current user has no local password, meaning the account authenticates via an external system (LDAP, SSO, OAuth). OneDev does not manage such credentials, so the change-password page refuses to render. The message is user-facing and localized.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/my/password/MyPasswordPage.java:23

import io.onedev.server.web.component.user.passwordedit.PasswordEditPanel;
import io.onedev.server.web.page.my.MyPage;

import static io.onedev.server.model.User.Type.ORDINARY;
import static io.onedev.server.web.translation.Translation._T;

import org.apache.wicket.Component;
import org.apache.wicket.markup.html.basic.Label;
import org.apache.wicket.model.AbstractReadOnlyModel;
import org.apache.wicket.request.mapper.parameter.PageParameters;

public class MyPasswordPage extends MyPage {
	
	public MyPasswordPage(PageParameters params) {
		super(params);
		if (getUser().getType() != ORDINARY || getUser().isDisabled())
			throw new IllegalStateException();
		if (getUser().getPassword() == null)
			throw new ExplicitException(_T("Unable to change password as you are authenticating via external system"));
	}

	@Override
	protected void onInitialize() {
		super.onInitialize();
		
		add(new PasswordEditPanel("content", new AbstractReadOnlyModel<User>() {

			@Override
			public User getObject() {
				return getUser();
			}
			
		}));
	}

	@Override
	protected Component newTopbarTitle(String componentId) {

View on GitHub (pinned to d44925c47c)

Solutions

Change the password in the external authentication system (LDAP/SSO provider) instead
If the user should be local, re-provision or convert the account so it has a local password set by an admin
Verify the user's authentication settings in admin security settings

Example fix

// before: navigating to /my/password for an LDAP user
// after: change password at your LDAP/SSO identity provider, then log in with it

Defensive patterns

Strategy: fallback

Validate before calling

if (user.getType() == ORDINARY && user.getPassword() == null) {
    // user is externally authenticated; direct to external IdP
}

Try / catch

try {
    openMyPasswordPage();
} catch (ExplicitException e) {
    redirectToExternalPasswordManagement();
}

Prevention

Use the external identity provider's password change flow for LDAP/SSO accounts
Check user.getPassword() != null before offering the change-password UI
Educate users that federated accounts are managed at the IdP

When it happens

Trigger: Opening the my-password page while logged in as an external-authentication user whose password field is null (e.g. LDAP or SSO-provisioned account).

Common situations: Users migrated to LDAP/SSO still trying the old password page; admins expecting per-user password reset for federated accounts.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/3ae79c0886c79a1a. Report an issue: GitHub.