Please see into com.atlassian.stash.internal.auth.EmbeddedCrowdHttpAuthenticationHandler line 52. In this line you will got NPE in case if user exists but password does not match.

It will print wrong message into log:

2016-12-28 21:38:23,452 WARN [catalina-exec-81] *198WUGFx1298x924x0 m0km28 2a02:6b8:0:1a16::20d,127.0.0.1 "GET /scm/project/repo.git/info/refs HTT
P/1.0" c.a.s.i.a.DefaultAuthenticationService Authenticator 'com.atlassian.bitbucket.server.bitbucket-authentication:crowdHttpAuthHandler' threw an exception
java.lang.NullPointerException: null

 

Actually no track trace will be printed. I enabled it in debug, here is it:

java.lang.NullPointerException: null
at com.atlassian.crowd.directory.AbstractInternalDirectory.authenticate(AbstractInternalDirectory.java:422) ~[crowd-persistence-2.10.2-rc04.jar:na]
at com.atlassian.crowd.directory.AbstractInternalDirectory.processAuthentication(AbstractInternalDirectory.java:256) ~[crowd-persistence-2.10.2-rc04.jar
:na]
at com.atlassian.crowd.directory.AbstractInternalDirectory.authenticate(AbstractInternalDirectory.java:222) ~[crowd-persistence-2.10.2-rc04.jar:na]
at com.atlassian.crowd.manager.directory.DirectoryManagerGeneric.authenticateUser(DirectoryManagerGeneric.java:311) ~[crowd-core-2.10.2-rc04.jar:na]
at com.atlassian.stash.internal.crowd.CustomizedDirectoryManager.authenticateUser(CustomizedDirectoryManager.java:53) ~[bitbucket-service-impl-4.12.0.ja
r:na]
at com.atlassian.crowd.manager.application.ApplicationServiceGeneric.authenticateUser(ApplicationServiceGeneric.java:198) ~[crowd-core-2.10.2-rc04.jar:n
a]
at com.atlassian.stash.internal.crowd.CustomizedApplicationService.authenticateUser(CustomizedApplicationService.java:50) ~[bitbucket-service-impl-4.12.
0.jar:na]
at com.atlassian.crowd.embedded.core.CrowdServiceImpl.authenticate(CrowdServiceImpl.java:75) ~[embedded-crowd-core-2.10.2-rc04.jar:na]
at com.atlassian.stash.internal.crowd.RiotPolice.authenticate(RiotPolice.java:109) ~[bitbucket-service-impl-4.12.0.jar:na]
at com.atlassian.stash.internal.plugin.OsgiSafeProxyProvider$1.invoke(OsgiSafeProxyProvider.java:93) ~[bitbucket-platform-4.12.0.jar:na]
at com.atlassian.stash.internal.auth.EmbeddedCrowdHttpAuthenticationHandler.authenticate(EmbeddedCrowdHttpAuthenticationHandler.java:51) ~[bitbucket-ser
vice-impl-4.12.0.jar:na]
at com.atlassian.stash.internal.auth.DefaultAuthenticationService.lambda$authenticateInternal$2(DefaultAuthenticationService.java:108) [bitbucket-servic
e-impl-4.12.0.jar:na]