Here is an interesting error. I'm working on an app that logs in to Salesforce using the SOAP API in .NET using SForceService. When it's run locally it logs in fine and goes about it's business.

When it's put up on another server it fails with (it takes a long time before it throws this error)

INVALID_LOGIN: Invalid username, password, security token; or user locked out.

Try it again locally and it works fine. Credentials are all the same. I log in to the org and look at the user's login history to try and get more details - there are no records at all from the server's IP address, only the local machine.

I'm thinking it's some sort of timeout or connectivity issue since there is no login history - but why the error about credentials? Has anyone experienced this before or have any ideas what the problem might be?

Update: I installed the Force.com Explorer on the target machine and logged in using the same credentials. That worked. So the credentials are definitely good. The problem has to be in the app or perhaps have something to do with the firewall? The same compiled app still runs fine on my local machine. It just hangs at Logging in and then fails as detailed above.

UPDATE: It was a config file issue. The config file it was using when deployed didn't have a username or password set at all. I guess I would have expected a slightly different error in that case but at least it explains everything.


That's an explicit error returned from the server, so you request made it to a server and back. did you deploy the config file for your app (is this a desktop app or a web app?), as normally the .NET tools put the server url into the config file. Perhaps your request is going to sandbox when it should be going to production or visa versa. (typically this, or a screw up with the username is why you don't see anything in login history). Are you sending the api security token? if not, check that the new host is white listed. (although you should see a login history entry for that).

  • This is a console app. It is fully self contained so it's running with the exact same configuration in both locations. I'm definitely sending the security token in both cases (I even tried not sending the security token to see if that was the issue). – Ryan Elkins Aug 24 '12 at 21:48
  • 4
    if you don't see an entry in login history, the request is either going to the wrong instance, or has the wrong username in. – superfell Aug 24 '12 at 22:54
  • 1
    and you deployed the app.exe.config file? perhaps a network sniffer might help confirm where your requests are going (e.g. wireshark) – superfell Aug 28 '12 at 15:51

Could you try using the problem credentials from another tool on the server that is throwing the error?

You could use:

  • The Data Loader
  • Force.com Explorer
  • Apex Explorer. While it has been replaced by the Force.com Explorer it was a .NET application. It could be hard to download now and the link appears to redirect to the newer tool.
  • FuseIT SFDC Explorer - This is a shameless plug, but it is free, .NET based, and it does work with the SForceService created from the Partner API internally.

The idea is to try and separate out if the issue is with the server, the credentials, or the .NET code/configuration.

  • I tried this using the Force.com Explorer on the target server - I was able to log in using the same credentials used in the exe. Not sure if this ultimately helps or not. The exact same exe logs in and works fine on my machine but bombs on the server with the bad credentials error. – Ryan Elkins Aug 28 '12 at 14:11
  • 1
    @RyanElkins it confirms a couple of things. Firstly, the credentials are fine. Second, there is no issue between the server and Salesforce. Which means the issue is somewhere in the exe or its configuration. Can you add some logging directly above the web service calls to show what is occurring on production? I'd log the salesforce server URL, user name, length of the password, etc... – Daniel Ballinger Aug 28 '12 at 20:09

Does the server's firewall allow your app? Assuming you are connecting to the correct instance, with proper credentials, it sounds like the traffic isn't making it to Salesforce. Have you tried watching the traffic with Wireshark or another similar tool?


Try regenerating the security token?

  • The security token is fine, I can log in running the app locally without a problem using the exact same credentials. – Ryan Elkins Aug 24 '12 at 21:46
  • Hmmm, well every-time I've seen that error it's been an expired security token. – jordan.baucke Aug 24 '12 at 21:47

The only thing that jumps to mind not mentioned already is concurrency - are other apps logging in as this user at the same time? I'm not sure what the limit is there.

  • 1
    that would return a different error. – superfell Aug 24 '12 at 22:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.