No storage service is configured to handle the account…

Error message

No storage service is configured to handle the account update and password service operations. Password management functionality will have no effect and will be disabled until a storage service is configured. To explicitly disable password management, add 'cas.authn.pm.core.enabled=false' to the CAS configuration

What it means

CAS logs this warning when password management is enabled (cas.authn.pm.core.enabled=true) but no PasswordManagementService beans (storage backends such as JDBC/Mongo/LDAP for account updates) were registered in the execution plan. The auto-configuration falls back to a chain that does nothing, so password management is effectively disabled.

Solutions

Add a storage module and configure it, e.g. cas.authn.pm.jdbc[0].url/user/password with the jdbc driver dependency.
If password management is not wanted, set cas.authn.pm.core.enabled=false to silence the warning and explicitly disable.
Verify the chosen pm storage module jar is on the classpath (overlay dependency) so its auto-configuration registers a PasswordManagementService.
Check startup logs for the backend's own configuration warnings indicating why its beans did not register.

Example fix

# before
cas.authn.pm.core.enabled=true
# after
cas.authn.pm.core.enabled=true
cas.authn.pm.jdbc[0].url=jdbc:hsqldb:mem:cas-pm
cas.authn.pm.jdbc[0].user=sa
cas.authn.pm.jdbc[0].password=sa
cas.authn.pm.jdbc[0].driver-class-name=org.hsqldb.jdbcDriver

Defensive patterns

Strategy: validation

Validate before calling

# check before enabling
assert cas_properties.get('cas.authn.pm.core.enabled') != 'true' or any(k.startswith('cas.authn.pm.jdbc') or k.startswith('cas.authn.pm.mongo') or k.startswith('cas.authn.pm.ldap') for k in cas_properties)

Prevention

Always pair cas.authn.pm.core.enabled=true with a concrete storage block
Smoke-test startup and grep logs for the 'No storage service' warning in CI
Set enabled=false explicitly when PM is not used

When it happens

Trigger: cas.authn.pm.core.enabled=true while no cas.authn.pm.* storage configuration (e.g. cas.authn.pm.jdbc, cas.authn.pm.mongo, cas.authn.pm.ldap) is present, so no PasswordManagementService beans exist to register.

Common situations: Enabling the feature flag but forgetting to add the JDBC/Mongo/LDAP pm module and its storage settings; misconfigured storage properties causing the backend bean to silently not register; wrong feature module not on classpath.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/9e4875596610948e. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-pm/src/main/java/org/apereo/cas/config/CasPasswordManagementAutoConfiguration.java:190

            final CasConfigurationProperties casProperties,
            @Qualifier("passwordManagementCipherExecutor")
            final CipherExecutor passwordManagementCipherExecutor,
            @Qualifier(PasswordHistoryService.BEAN_NAME)
            final PasswordHistoryService passwordHistoryService) {
            val pm = casProperties.getAuthn().getPm();
            if (pm.getCore().isEnabled()) {
                val plans = applicationContext.getBeansOfType(PasswordManagementExecutionPlan.class).values();
                val registeredServices = plans
                    .stream()
                    .filter(BeanSupplier::isNotProxy)
                    .sorted(AnnotationAwareOrderComparator.INSTANCE)
                    .map(PasswordManagementExecutionPlan::registerPasswordManagementService)
                    .filter(BeanSupplier::isNotProxy)
                    .toList();
                if (!registeredServices.isEmpty()) {
                    return new ChainingPasswordManagementService(registeredServices);
                }
                LOGGER.warn("No storage service is configured to handle the account update and password service operations. "
                    + "Password management functionality will have no effect and will be disabled until a storage service is configured. "
                    + "To explicitly disable password management, add 'cas.authn.pm.core.enabled=false' to the CAS configuration");
            } else {
                LOGGER.debug("Password management is disabled. To enable the password management functionality, "
                    + "add 'cas.authn.pm.core.enabled=true' to the CAS configuration and then configure storage options for account updates");
            }
            return new NoOpPasswordManagementService(passwordManagementCipherExecutor, casProperties);
        }

        @Bean
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        @ConditionalOnMissingBean(name = "groovyPasswordChangeService")
        @ConditionalOnMissingGraalVMNativeImage
        public PasswordManagementExecutionPlan groovyPasswordChangeService(
            final ConfigurableApplicationContext applicationContext,
            @Qualifier("passwordManagementCipherExecutor")
            final CipherExecutor passwordManagementCipherExecutor,
            @Qualifier(PasswordHistoryService.BEAN_NAME)

View on GitHub (pinned to e7288fc434)