What causes "No values remaining for attribute" in apereo/cas?

Correct the configured principal attribute so it matches attributes actually present in the certificate DNs.

apereo/cas · error · IllegalStateException

No values remaining for attribute

Error message

No values remaining for attribute

What it means

X509SubjectPrincipalResolver builds the principal from subject DN attribute values; nextValue() is the internal per-attribute iterator. When all values of the attribute are consumed and another is requested, it throws IllegalStateException('No values remaining for attribute'), an invariant violation meaning the resolver asked for more values than the DN provides.

Solutions

Correct the configured principal attribute so it matches attributes actually present in the certificate DNs.
Use single-value resolution (e.g. CN) for certificates with minimal subject DNs.
Log the full subject DN to confirm available attributes, then align configuration.
Ensure authentication failures from bad DNs surface as normal FailedLoginException rather than an uncaught IllegalStateException.

Example fix

// before
cas.authn.x509.principal.principal-attribute=SERIALNUMBER
// after
cas.authn.x509.principal.principal-attribute=CN

Defensive patterns

Strategy: type-guard

Validate before calling

String dn = cert.getSubjectX500Principal().getName();
LdapName name = new LdapName(dn);
boolean hasAttr = name.getRdns().stream().anyMatch(rdn -> rdn.getType().equalsIgnoreCase("CN"));
if (!hasAttr) { reject("principal attribute absent from DN"); }

Type guard

boolean dnHasAttribute(X509Certificate cert, String type) {
    return cert.getSubjectX500Principal().getName(X500Principal.RFC2253).contains(type + "=");
}

Try / catch

try {
    principalResolver.resolve(credential);
} catch (IllegalStateException e) {
    // attribute values exhausted: fall back to a single-value attribute like CN
}

Prevention

Verify the configured principal attribute exists in real client certificate DNs.
Prefer single-value attributes (CN) for minimal subject DNs.
Log the full DN when debugging principal resolution.
Re-check config after CA migrations that change DN layout.

When it happens

Trigger: The subject DN contains fewer values for the configured principal attribute than the resolution logic iterates — e.g. a misconfigured/typo'd attribute name yields an empty or single-value array that the multi-value resolution still walks.

Common situations: principal-attribute configured to an attribute absent from client certificate DNs (e.g. SERIALNUMBER when certs have CN only); multi-value resolution mode combined with minimal subject DNs; DN layout changes after a CA migration.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/cc9f0b651ed18d50. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509SubjectPrincipalResolver.java:127

    private static final class AttributeContext {

        private final Object[] values;
        private int currentIndex;

        AttributeContext(final String[] values) {
            this.values = ArrayUtils.clone(values);
        }

        /**
         * Retrieve the next value, by incrementing the current index.
         *
         * @return the string
         * @throws IllegalStateException if no values are remaining.
         */
        String nextValue() {
            if (this.currentIndex == this.values.length) {
                throw new IllegalStateException("No values remaining for attribute");
            }
            val value = this.values[this.currentIndex].toString();
            this.currentIndex++;
            return value;
        }
    }
}

View on GitHub (pinned to e7288fc434)