"Invalid Username or Password" when users log into PaperCut NG or MF

This article helps you troubleshoot the “Invalid username or password” error when users log in to PaperCut NG or MF, including Print Deploy. It covers common causes and the steps to resolve them, whether the issue affects one user or all of them. If you’re seeing this error when logging into Mobility Print instead see: Invalid username or password’ when trying to log into Mobility Print . Check the basics Before troubleshooting further, confirm these basic points: Correct credentials: Ensure you are entering the correct username and password. Keyboard settings: Verify that Caps Lock or Num Lock keys are not enabled. User account existence: Confirm the user account exists in PaperCut and that the username entered matches the username in PaperCut. Sync source status: Check if the user’s account is disabled or locked out in the sync source (e.g., Active Directory). Built-in ‘admin’ account: If this error specifically affects the built-in ‘admin’ account, refer to Resetting the Admin Password . For students If you are a student, contact the IT Help Desk at your school for assistance. PaperCut support cannot help you directly because your school's IT department manages the system and user accounts. For more information, see I'm a Student - How do I log in?. If users cannot log in to the PaperCut web interface, the administrator should check the PaperCut application log for errors that could be causing the problem. If errors are occurring they should help in understanding why logons are failing. Reset the individual user’s password The steps to reset a password depend on whether the user is managed internally by PaperCut or synchronized from an external user directory (like Active Directory, LDAP, Microsoft Entra ID, or Google Workspace). To determine if a user is internal or external, try resetting their password: In the PaperCut admin interface, go to the Users section. Select the user you want to check. On the user’s details page, look for the Internal User Settings section. If you see this section, they are an internal user and you can click Change password to reset their password . If this section is not visible, the user is an external user. Their password must be reset in the external directory (for example, Active Directory). Troubleshooting User Directory Sync Issues If all the users are having issues logging in, there may be an issue with PaperCut NG or MF connecting to the external user directory. If this is the case, internal user accounts like the built-in admin account will have no problem logging in. To test the user and group sync connection: Log in to the PaperCut admin interface. Navigate to Options > User/Group Sync. Under Sync Options click Test Connection to verify that PaperCut can communicate with the directory. If the connection is successful, click Sync Now to start a manual synchronization. Make a note of any errors that appear in the sync progress window or on the User/Group Sync tab. If you find connection or synchronization errors, refer to the relevant guide for your sync source: Troubleshooting User/Group Sync with Active Directory Troubleshooting User/Group Sync with LDAP Troubleshooting User/Group Sync with Google Cloud Directory Troubleshooting User/Group Sync with Microsoft Entra ID Review logs for detailed error messages If the sync test is successful but users still cannot log in, the PaperCut server logs may contain a more specific error message. While users see a generic “Invalid username or password” error, the logs often provide more detail for administrators. To find the detailed error: Enable debug logging . Try logging in as a user to reproduce the issue. Download the diagnostic bundle. In the diagnostic bundle, open the /server folder and check the server.log file for entries containing “invalid username or password”. A more specific error message often follows this log line. Examples of login errors in the logs Below are some examples of login issues we’ve seen which can cause an “Invalid username or password” error depending on which sync source you have configured. Active Directory login errors Look in the server.log file for “Failed to authenticate user” and make a note of the error that follows. Active Directory login errors often contain the phrase "AcceptSecurityContext". Below we've included an example error line, along with a table of errors we've seen and their resolutions. Example full error line: 2025-02-26 14:44:53,049 DEBUG UserCoordinatorImpl - Failed to authenticate user: norville.rogers, with error: Error: Incorrect function. AcceptSecurityContext failed with 80090302. Please check this user's machine logon restrictions.Error Cause and solution AcceptSecurityContext failed with 80090302 Cause: This error can be caused by NTLM security policy settings. Solution: Modify the following NTLM settings: "Network security: Restrict NTLM: Incoming NTLM traffic: Allow all" "Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Allow all" AcceptSecurityContext failed with 80090304 Cause: This error can occur if the user attempting to log in is restricted to "Log on to" specific machines, and the server running PaperCut is not on that list. Solution: Open the "Active Directory Users and Computers" tool. Select the user who experienced the error, right-click, and select Properties. Select the Account tab. Click the Log On to button. By default, all users can log in to all computers. If "This user can only log in to the following computers" is enabled, ensure the PaperCut server is included in the list. Adding the PaperCut server to this list is safe, as you can restrict local login access to that server using Group Policy. Next, click on "Logon Hours…". Verify the user is allowed to log on at all times. Note: If you have multiple domains, you must check these settings for users across all domains. Changing these settings for the affected users will resolve the logon issue. AcceptSecurityContext failed with 80090311 Solution: Confirm the Windows 'Netlogon' service is running. Some customers have reported that disjoining the server from the domain and re-adding it resolved this issue. Active Directory - Domain Trust IssuesRunning multiple Active Directory domains? If PaperCut NG or MF is syncing users but not authenticating them, domain trust might not be set up correctly. We've seen cases where users import successfully, but login fails because the authentication request can't cross domain boundaries. To fix this, check your domain trust settings and review our guide on Configuring PaperCut for Multiple Active Directory Domains. Microsoft Entra ID login errors Error AADSTS50076 or AADSTS50079 You might encounter either error message AADSTS50076 or AADSTS50079 from Microsoft when users try to log in to PaperCut NG or MF. This occurs when logging in with a username and password, using Microsoft Entra ID sync, and two-factor authentication (also known as multi-factor authentication) is enabled. Example full error line: 2024-05-23 10:33:45,239 INFO PrintJobAuthorizationController - Invalid authentication: [Invalid username or password., AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access '00000003-0000-0000-c000-000000000000'. Trace ID: 4d355636-ebbc-4171-918a-46e528953e00 Correlation ID: 20c15871-a571-4fb3-af80-27798b46c096 Timestamp: 2024-05-23 14:33:45Z] [http-31]The most up-to-date versions of PaperCut NG and MF support two-factor authentication for logging into all web-based authentication pages (admin and web applications, Mobile Release web client, and Web accessibility user client) as well as the PaperCut user client. However, you may still see this error message in the logs in some unsupported scenarios, such as when a user attempts to log into a copier with a username and password. For more details on versions, requirements, and what is and isn’t supported, see Considerations when using ‘standard’ Microsoft Entra ID (Azure AD) with MFA. Prior to version 23.0.1, two-factor authentication was not supported for user logins. Our advice then was to configure your security policy to exclude two-factor authentication for the PaperCut Application Server app, or the PaperCut app server device when applying conditional policies at the machine level. Google Cloud Directory login errors Error code 50When checking the server.log file, you might find an additional error message stating “Error code 50 - Insufficient Access Rights” returned by Google. This Google support article provides detailed information on various reasons for LDAP error code 50.