apereo/cas · warning

No username parameter is provided

Error message

No username parameter is provided

What it means

CAS password management logs this warning when the password-reset instructions flow cannot find a 'username' request parameter, so the PasswordManagementQuery is built with a blank username. The subsequent reset-instruction submission cannot identify which account to email, so the flow will fail or return an invalid-contact event.

Solutions

1. Add a required, non-empty 'username' input field to the password-reset form and submit it with the request.
2. Verify the form field's name attribute is exactly 'username' and that the request method carries it (form-encoded POST or query string).
3. If the caller is a script/integration, include ?username=<value> in the request to the password management endpoint.
4. Ensure any proxy/gateway is not stripping form parameters on POST bodies.

Example fix

// before
curl -X POST https://cas.example.org/cas/pm/webflow?execution=... -d ''
// after
curl -X POST 'https://cas.example.org/cas/pm/webflow?execution=...' -d 'username=jdoe'

const username = params.get('username');
if (!username || username.trim() === '') {
  throw new Error('username parameter is required for password reset');
}

When it happens

Trigger: A user (or automation) POSTs to the password reset instructions endpoint without the required 'username' form/HTTP parameter, i.e. WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext).getParameter("username") returns null or blank.

Common situations: Custom reset pages that omit the username field; direct URL access to the forgot-password flow without query params; bots hitting the endpoint; renamed parameter in a custom front-end after a CAS upgrade.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• No security questions could be found for
• No service authentication request is available at
• Recaptcha response/token is missing from the request
• No surrogate identifier was selected or provided
• Missing web authn token from the request

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/868665b9e090f7b3. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/SendPasswordResetInstructionsAction.java:249

    protected @Nullable MultifactorAuthenticationProvider selectMultifactorAuthenticationProvider(
        final RequestContext requestContext,
        final Principal principal) throws Throwable {
        val applicationContext = requestContext.getActiveFlow().getApplicationContext();
        val providers = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(applicationContext);
        val registeredService = WebUtils.getRegisteredService(requestContext);
        return multifactorAuthenticationProviderSelector.resolve(providers.values(), registeredService, principal);
    }

    protected PasswordManagementQuery buildPasswordManagementQuery(final RequestContext requestContext) {
        val existingQuery = WebUtils.getPasswordManagementQuery(requestContext, PasswordManagementQuery.class);
        return Optional.ofNullable(existingQuery)
            .orElseGet(() -> {
                val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
                val username = request.getParameter(REQUEST_PARAMETER_USERNAME);

                val builder = PasswordManagementQuery.builder();
                if (StringUtils.isBlank(username)) {
                    LOGGER.warn("No username parameter is provided");
                }
                return builder.username(username).build();
            });
    }

    protected Event getInvalidContactEvent(final RequestContext requestContext) {
        return getErrorEvent("contact.invalid", "Provided email address or phone number is invalid", requestContext);
    }

    protected boolean sendPasswordResetSmsToAccount(final RequestContext requestContext,
                                                    final List<String> recipients, final URL url) throws Throwable {
        if (!recipients.isEmpty()) {
            LOGGER.debug("Sending password reset URL [{}] via SMS to [{}]", url.toExternalForm(), recipients);
            val reset = casProperties.getAuthn().getPm().getReset().getSms();
            val message = SmsBodyBuilder.builder().properties(reset).parameters(Map.of("url",
                url.toExternalForm())).build().get();
            val smsRequest = SmsRequest.builder()
                .from(reset.getFrom())

View on GitHub (pinned to e7288fc434)