Cannot log in to TeamCity after password reset: use the username, not the email

Symptoms

In TeamCity with the built-in authentication module (On-Premises or Cloud), a password reset appears to succeed: the reset page confirms a new password was set and opens the profile page. The next login with that password is rejected, so the reset has to be repeated to regain access, sometimes once a day. The failure also reproduces in a private (incognito) browser window and after signing out, which rules out a stale session or cached credentials.

Cause

TeamCity's built-in authentication identifies an account by its login name (username), which can be different from the account's email address. The password-reset form, in contrast, accepts the email address, because email is the identifier used to send the reset link.

This creates a loop. A reset requested with the email address always succeeds, and opening the reset link signs the session in through a one-time token, which looks like a successful login. The next sign-in on the login page, entered with the email address, matches no login name and is rejected, which prompts another reset. The password is stored correctly the whole time. The rejected logins use an identifier (the email) that built-in authentication does not accept.

Resolution

Sign in with the username (login name) rather than the email address. The username appears on the password-reset page in the confirmation line, for example "Please specify new password for the user John Doe (jdoe)", where the value in parentheses (jdoe) is the username. It is also shown as the Username field on the account's profile page. After signing in with the username, the password set during the reset works on the first attempt.

When the problem appears only recently on an account that worked before, the usual trigger is a browser or password manager that began autofilling the email address into the Username field instead of the stored login name. The email address never worked as a login identifier; the change in what gets filled in is what surfaces the behavior. Typing the username by hand confirms it.

Additional information

If sign-in with the correct username is still rejected, the server may use an external authentication module (LDAP, SAML, or NTLM) instead of built-in authentication. Confirm the configured modules under Administration | Authentication, and review the teamcity-auth.log server log for the entries written at the time of the failed sign-in. These steps require administrator access.