Uploaded image for project: 'XWiki Platform'
  1. XWiki Platform
  2. XWIKI-25199

PasswordClass related error when login with Admin after an instance upgrade

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Blocker
    • 18.9.0-rc-1, 18.4.7
    • 18.4.6, 18.8.0
    • Old Core
    • Windows 11 Pro, Firefox 157, using an instance of XWiki 18.4.6 on Oracle 19c, Tomcat 11, and Jetty/HSQL
    • Unit
    • Unknown
    • N/A
    • N/A

    Description

      Steps to reproduce

      1. Create an older instance of XWiki (I've reproduced with 12.10.11 and 13.4.7)
      2. Upgrade this instance to XWiki 18.4.6 (by copying the "data" folder to the new instance's folder - on Jetty for ex.)
      3. To better reproduce the issue, if already logged in with Admin, start the 18.4.6 instance on a different port (the idea is to login after starting the instance, or just logout and re-login after upgrade)
      4. After the 18.4.6 instance is started, login with Admin
      5. Observe the logs

      Expected results

      No error are displayed.

      Actual results

      The following error is displayed:

      2026-10-07 15:19:50,456 [http-nio-1115-exec-8 - http://localhost:1115/xwiki/bin/loginsubmit/XWiki/XWikiLogin] ERROR c.x.x.o.c.PasswordClass        - An outdated algorithm [XWikiLegacy] (or an outdated version of it) is used in a PasswordClass property not yet attached to an object
      java.lang.Exception
              at com.xpn.xwiki.objects.classes.PasswordClass.warnAboutOutdatedAlgorithm(PasswordClass.java:473)
              at com.xpn.xwiki.objects.classes.PasswordClass.arePasswordsMatching(PasswordClass.java:443)
              at com.xpn.xwiki.objects.BaseCollection.isPasswordValueMatching(BaseCollection.java:684)
              at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkPassword(XWikiAuthServiceImpl.java:450)
              at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.authenticate(XWikiAuthServiceImpl.java:379)
              at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.authenticate(StandardXWikiAuthServiceComponent.java:81)
              at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.authenticate(MyFormAuthenticator.java:292)
              at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:213)
              at com.xpn.xwiki.user.impl.xwiki.MyFormAuthenticator.processLogin(MyFormAuthenticator.java:195)
              at com.xpn.xwiki.user.impl.xwiki.XWikiAuthServiceImpl.checkAuth(XWikiAuthServiceImpl.java:203)
              at org.xwiki.security.authservice.internal.StandardXWikiAuthServiceComponent.checkAuth(StandardXWikiAuthServiceComponent.java:62)
              at com.xpn.xwiki.XWiki.checkAuth(XWiki.java:4413)
              at org.xwiki.security.authorization.internal.XWikiCachingRightService.authenticateUser(XWikiCachingRightService.java:238)
              at org.xwiki.security.authorization.internal.XWikiCachingRightService.checkAccess(XWikiCachingRightService.java:268)
              at com.xpn.xwiki.XWiki.checkAccess(XWiki.java:4436)
              at com.xpn.xwiki.XWiki.prepareDocuments(XWiki.java:6014)
              at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:548)
              at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:339)
              at com.xpn.xwiki.web.LegacyActionServlet.service(LegacyActionServlet.java:111)
              at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:710)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:132)
              at com.xpn.xwiki.web.ActionFilter.doFilter(ActionFilter.java:123)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.wysiwyg.filter.ConversionFilter.doFilter(ConversionFilter.java:71)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:59)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.SetHTTPHeaderFilter.doFilter(SetHTTPHeaderFilter.java:66)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.resource.servlet.RoutingFilter.doFilter(RoutingFilter.java:135)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.SavedRequestRestorerFilter.doFilter(SavedRequestRestorerFilter.java:240)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.SafeRedirectFilter.doFilter(SafeRedirectFilter.java:106)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.ResolveRelativeRedirectFilter.doFilter(ResolveRelativeRedirectFilter.java:129)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.SourceURLResolverFilter.doFilter(SourceURLResolverFilter.java:177)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.xwiki.container.servlet.filters.internal.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:120)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:111)
              at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166)
              at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:77)
              at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:540)
              at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115)
              at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:86)
              at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:782)
              at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:71)
              at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:347)
              at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408)
              at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:71)
              at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:1307)
              at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:2201)
              at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:74)
              at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:949)
              at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:483)
              at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:74)
              at java.base/java.lang.Thread.run(Thread.java:1474)

      The upgrade, however, if being finished. But it seems the error occurs each time the Admin logins.

      The issue could be reproduced on Jetty Standalone (with 12.10.11) and on Tomcat 11 (with 13.4.7 on Oracle 19c) and could not be reproduced when upgrading to XWiki 18.4.5.

      Attachments

        Issue Links

          Activity

            People

              surli Simon Urli
              iandriuta Ilie Andriuta
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: