What causes "Password cannot be blank" in apereo/cas?

Supply a non-blank password in the UsernamePasswordAuthenticationToken/credentials before calling authenticate

apereo/cas · error · IllegalArgumentException

Password cannot be blank

Error message

Password cannot be blank

What it means

EndpointLdapAuthenticationProvider.authenticate() (the actuator-endpoint authentication provider) rejects any Authentication whose credentials are null or blank with IllegalArgumentException, because an LDAP bind with an empty password is meaningless and some directories treat empty-password binds as anonymous success.

Solutions

Supply a non-blank password in the UsernamePasswordAuthenticationToken/credentials before calling authenticate
Fix the client payload so the password parameter is actually populated and named correctly
Validate input at your controller/proxy before invoking the provider

Example fix

// before
new UsernamePasswordAuthenticationToken(user, null);
// after
new UsernamePasswordAuthenticationToken(user, password.trim());

Defensive patterns

Strategy: validation

Validate before calling

if (password == null || password.isBlank()) {
    throw new IllegalArgumentException("Password is required for endpoint authentication");
}

Try / catch

try {
    provider.authenticate(token);
} catch (IllegalArgumentException e) {
    if ("Password cannot be blank".equals(e.getMessage())) {
        // reject the request with 400: missing password
    }
}

Prevention

Validate username/password at the API layer before constructing the Authentication token
Ensure form/JSON field names map correctly to the password parameter
Never call authenticate() with null credentials — fail fast in your own controller

When it happens

Trigger: Calling authenticate(new UsernamePasswordAuthenticationToken(user, null)) or with "" as credentials — e.g. an endpoint client that posts a username but omits the password field.

Common situations: Management/console tooling sending incomplete credentials to the CAS actuator endpoint; scripts building the Authentication token programmatically and forgetting credentials; form field name mismatch so the password never reaches the token.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/a0f860a6481e802e. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authorization/EndpointLdapAuthenticationProvider.java:68

        return new UsernamePasswordAuthenticationToken(username, credentials, authorities);
    }

    /**
     * Destroy.
     */
    @Override
    public void destroy() {
        authenticator.close();
    }

    @Override
    public Authentication authenticate(final Authentication authentication) throws AuthenticationException {
        try {
            val username = Objects.requireNonNull(authentication.getPrincipal()).toString();
            val credentials = authentication.getCredentials();
            val password = Optional.ofNullable(credentials).map(Object::toString).orElse(null);
            if (StringUtils.isBlank(password)) {
                throw new IllegalArgumentException("Password cannot be blank");
            }
            LOGGER.debug("Preparing LDAP authentication request for user [{}]", username);
            val request = new AuthenticationRequest(username, new Credential(password), ReturnAttributes.ALL.value());
            LOGGER.debug("Executing LDAP authentication request for user [{}]", username);

            val response = authenticator.authenticate(request);
            LOGGER.debug("LDAP response: [{}]", response);

            if (response.isSuccess()) {
                val requiredRoles = securityProperties
                    .getUser()
                    .getRoles()
                    .stream()
                    .map(role -> Strings.CI.prependIfMissing(role, ldapProperties.getLdapAuthz().getRolePrefix()))
                    .map(String::toUpperCase)
                    .collect(Collectors.toList());

                LOGGER.debug("Required roles are [{}]", requiredRoles);

View on GitHub (pinned to e7288fc434)