---
title: Data Store Decision node
description: Authenticate users by verifying that their credentials match those stored in the configured data store for the realm.
component: auth-node-ref
version: 8
page_id: auth-node-ref::data-store-decision
canonical_url: https://docs.pingidentity.com/auth-node-ref/latest/data-store-decision.html
llms_txt: https://docs.pingidentity.com/auth-node-ref/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
keywords: ["Nodes & Trees", "Journeys", "Authentication", "Identity Store", "LDAP", "Data Store"]
page_aliases: ["auth-node-data-store-decision.adoc"]
superseded_by: https://docs.pingidentity.com/auth-node-ref/latest/data-store-decision.html
section_ids:
  examples: Examples
  datastore-decision-example1: "Example 1: Simple username and password collector nodes with Data Store Decision node"
  datastore-decision-example2: "Example 2: Grant the user several attempts to enter their credentials correctly"
  availability: Availability
  inputs: Inputs
  dependencies: Dependencies
  configuration: Configuration
  outputs: Outputs
  callbacks: Callbacks
  outcomes: Outcomes
  errors: Errors
---

# Data Store Decision node

The Data Store Decision node checks that the credentials provided during authentication match the ones stored in the configured data store for the realm.

Alternatively, you can use the [LDAP Decision node](ldap-decision.html), which supports LDAP Behera Password Policies with separate outcomes for accounts that are locked and passwords that have expired.

## Examples

### Example 1: Simple username and password collector nodes with Data Store Decision node

![data store decision login](_images/data-store-decision-login.png)

This example illustrates a simple login process. The journey involves a [Page node](page.html) that contains two embedded nodes: [Platform Username node](platform-username.html) and [Platform Password node](platform-password.html). To enhance user experience, the Page node lets users input their username and password on a single page, instead of splitting them across two different pages.

The Data Store Decision node has two outcomes: `True` or `False`. When the outcome is `True`, it triggers a [Login Count Decision node](login-count-decision.html). The [Increment Login Count node](increment-login-count.html) then moves to an [Inner Tree Evaluator node](inner-tree-evaluator.html), which performs additional login processes. The `False` outcome connects directly to a failure node, indicating a failed state where the username and/or password provided by the user did not match the information stored in the data store.

### Example 2: Grant the user several attempts to enter their credentials correctly

![data store decision with retry](_images/data-store-decision-with-retry.png)

In the following example, when an authentication attempt fails at the Data Store Decision node, you can direct it to a [Retry Limit Decision node](retry-limit-decision.html). The [Retry Limit Decision node](retry-limit-decision.html) determines the number of retries allowed and either retries the login attempt or rejects it. If the journey rejects the login attempt after reaching the configured limit, for example three attempts, the operation results in an account lockout.

## Availability

| Product                               | Available? |
| ------------------------------------- | ---------- |
| PingOne Advanced Identity Cloud       | Yes        |
| PingAM (self-managed)                 | Yes        |
| Ping Identity Platform (self-managed) | Yes        |

## Inputs

This node requires the `realm`, `username`, and `password` properties in the incoming node state.

For standalone AM deployments, implement a [Username Collector node](am-only/username-collector.html) and a [Password Collector node](am-only/password-collector.html) earlier in the journey.

For Ping Identity Platform deployments, implement a [Platform Username node](platform-username.html) and a [Platform Password node](platform-password.html) earlier in the journey.

Alternatively, implement a [Zero Page Login Collector node](zero-page-login-collector.html).

## Dependencies

The Data Store Decision node is a basic node used in many authentication application types, such as basic, push, OAuth 2.0, and social provider authentication applications.

## Configuration

This node has no configurable properties.

## Outputs

This node copies shared and transient state into the outgoing node state.

## Callbacks

This node doesn't send any callbacks.

## Outcomes

Returns a boolean outcome:

* `True`

  The credentials match those found in the data store.

* `False`

  The credentials don't match those found in the data store.

## Errors

The node can log the following:

* Warnings

  * `invalid password error`

    The password doesn't match.

  * `invalid username error`

    The username doesn't match any profiles found in the data store.

  * `Exception in data store decision node`

    The node couldn't connect to the data store, or another error occurred.

* Errors

  * Password is null for username *username*

    The password is missing from the shared state for the user.