xkcoding/spring-boot-demo · warning · ServiceException

用户名或密码错误，请重新尝试

Error message

用户名或密码错误，请重新尝试

What it means

Thrown during LDAP login when personRepository.findByUid(username) returns an empty/null Person — the uid does not exist in the LDAP directory. The message deliberately says 'username or password incorrect' rather than 'user not found' to prevent user-enumeration attacks (a common security best practice). The ServiceException is a RuntimeException.

Source

Thrown at demo-ldap/src/main/java/com/xkcoding/ldap/service/impl/PersonServiceImpl.java:45

@RequiredArgsConstructor(onConstructor_ = @Autowired)
public class PersonServiceImpl implements PersonService {
    private final PersonRepository personRepository;

    /**
     * 登录
     *
     * @param request {@link LoginRequest}
     * @return {@link Result}
     */
    @Override
    public Result login(LoginRequest request) {
        log.info("IN LDAP auth");

        Person user = personRepository.findByUid(request.getUsername());

        try {
            if (ObjectUtils.isEmpty(user)) {
                throw new ServiceException("用户名或密码错误，请重新尝试");
            } else {
                user.setUserPassword(LdapUtils.asciiToString(user.getUserPassword()));
                if (!LdapUtils.verify(user.getUserPassword(), request.getPassword())) {
                    throw new ServiceException("用户名或密码错误，请重新尝试");
                }
            }
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        }

        log.info("user info:{}", user);
        return Result.success(user);
    }

    /**
     * 查询全部
     *
     * @return {@link Result}

View on GitHub (pinned to 87a142f960)

Solutions

1. Verify the user's uid exists in the LDAP directory using an LDAP browser (e.g., Apache Directory Studio) or ldapsearch.
2. Check the Spring LDAP context-source base DN configuration matches the directory structure.
3. Confirm uid attribute case matches the stored value (LDAP uid is often case-sensitive).
4. Ensure the login form sends the correct field mapped to request.getUsername().

// Validate username is non-empty before calling login
if (StrUtil.isBlank(request.getUsername())) {
    return Result.fail("用户名不能为空");
}

try {
    Result result = personService.login(request);
    return result;
} catch (ServiceException e) {
    // Both 'user not found' and 'wrong password' produce the same message — do not distinguish
    log.warn("LDAP login failed for username={}", request.getUsername());
    return Result.fail(e.getMessage());
}

When it happens

Trigger: POST to the login endpoint with a username that does not match any uid in the LDAP directory. ObjectUtils.isEmpty(user) evaluates true because findByUid returns null for a non-existent uid.

Common situations: User mistyped their uid; the LDAP directory has not been populated with the user entry; the LDAP server connection succeeded but the search base DN is wrong so no entries are found; case sensitivity mismatch on uid.

Related errors

• 请求错误，用户尚未登录
• 401
• 5002
• 5003

AI-assisted analysis of xkcoding/spring-boot-demo@87a142f960 (2026-08-14). Data as JSON: /api/errors/dcdb7b8977797a73. Report an issue: GitHub.