What causes "No user can be accepted because none is defined" in apereo/cas?

Set cas.authn.accept.users, e.g. casuser::Mellon (or populate the users map in the bean)

apereo/cas · error · FailedLoginException

No user can be accepted because none is defined

Error message

No user can be accepted because none is defined

What it means

AcceptUsersAuthenticationHandler (static in-memory username/password map) throws FailedLoginException when its users map is null or empty, since no credential could ever succeed. It indicates the handler is registered but was never populated with accepted users.

Solutions

Set cas.authn.accept.users, e.g. casuser::Mellon (or populate the users map in the bean)
Remove the AcceptUsersAuthenticationHandler if in-memory acceptance is not intended
Switch to a real credential source (LDAP/JDBC/etc.) instead of the static handler

Example fix

// before
cas.authn.accept.users=
// after
cas.authn.accept.users=casuser::Mellon

Defensive patterns

Strategy: validation

Validate before calling

// before startup
if (casProperties.getAuthn().getAccept().getUsers() == null || casProperties.getAuthn().getAccept().getUsers().isEmpty()) {
    throw new IllegalStateException("cas.authn.accept.users must be defined when the accept-users handler is enabled");
}

Try / catch

try {
    handlerResult = acceptUsersHandler.authenticate(credential, service);
} catch (FailedLoginException e) {
    if ("No user can be accepted because none is defined".equals(e.getMessage())) {
        LOGGER.error("Populate cas.authn.accept.users or disable the accept-users handler");
    }
}

Prevention

Always set cas.authn.accept.users when relying on the static handler
Validate authentication configuration at startup
Prefer a real credential source over the in-memory handler for production

When it happens

Trigger: cas.authn.accept.users is blank/unset (or the bean is built with an empty map) and a UsernamePasswordCredential is submitted to this handler.

Common situations: Deployments where cas.authn.accept.users was never set or lost during property migration; test/static deployments promoted without configuration.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/acabbc804a20c7c2. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java:61

    public AcceptUsersAuthenticationHandler(final String name) {
        this(name, PrincipalFactoryUtils.newPrincipalFactory(), Integer.MAX_VALUE, new HashMap<>());
    }

    public AcceptUsersAuthenticationHandler(final @Nullable String name,
                                            final PrincipalFactory principalFactory, final Integer order,
                                            final Map<String, String> users) {
        super(name, principalFactory, order);
        this.users = users;
    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(
        final UsernamePasswordCredential credential,
        @Nullable final String originalPassword) throws Throwable {

        if (this.users == null || this.users.isEmpty()) {
            throw new FailedLoginException("No user can be accepted because none is defined");
        }
        val username = credential.getUsername();
        val cachedPassword = this.users.get(username);
        if (cachedPassword == null) {
            LOGGER.debug("[{}] was not found in the map.", username);
            throw new AccountNotFoundException(username + " not found in backing map.");
        }
        if (!Strings.CS.equals(credential.toPassword(), cachedPassword)) {
            throw new FailedLoginException();
        }
        val strategy = getPasswordPolicyHandlingStrategy();
        if (strategy != null && StringUtils.isNotBlank(username)) {
            LOGGER.debug("Attempting to examine and handle password policy via [{}]", strategy.getClass().getSimpleName());
            val principal = this.principalFactory.createPrincipal(username);
            val messageList = strategy.handle(principal, getPasswordPolicyConfiguration());
            return createHandlerResult(credential, principal, messageList);
        }
        throw new FailedLoginException("Unable to authenticate " + credential.getId());

View on GitHub (pinned to e7288fc434)