What does log tell you? If you are using LDAP, you probably should add the users in your LDAP directory. If the users do not have a matching account in the LDAP, their password cannot be correct, unless you specified an exception role. See the documentation.