Passwordless account

Error message

Passwordless account [{}] does not require a password

What it means

AcceptPasswordlessSelectionMenuAction rejects the user's menu selection of PASSWORD when the passwordless account is configured as passwordless-only (doesPasswordlessAccountRequestPassword is false); it logs this warning and routes to an error event instead of the password flow.

Solutions

Verify the passwordless account definition requires a password (passwordless mode setting in the user account store)
Have the user choose the correct option (delegation or MFA)
Refresh/restart the flow so the menu only presents valid options
Check custom PasswordlessUserAccountCustomizer logic overriding the password flag

Example fix

null

Defensive patterns

Strategy: validation

Validate before calling

if (selection == PasswordlessSelectionMenu.PASSWORD && !account.isRequestPassword()) renderMenuAgain(account);

Prevention

Render menu options strictly from the account definition
Avoid caching selection pages across users
Handle the error event with a friendly retry page

When it happens

Trigger: User selects the PASSWORD option in the passwordless selection menu while the resolved PasswordlessUserAccount indicates no password is required (e.g. account is delegated/MFA only).

Common situations: Stale UI state showing the password option after account config changed; user manipulating request parameters to force the password option; menu options not derived from the account definition.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/efd528382b441a99. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java:47

                                                 final MultifactorAuthenticationTriggerSelectionStrategy multifactorTriggerSelectionStrategy,
                                                 final PrincipalFactory passwordlessPrincipalFactory,
                                                 final AuthenticationSystemSupport authenticationSystemSupport) {
        super(casProperties, multifactorTriggerSelectionStrategy, passwordlessPrincipalFactory, authenticationSystemSupport);
        this.passwordlessUserAccountStore = passwordlessUserAccountStore;
    }

    @Override
    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));

        if (!user.isAllowSelectionMenu()) {
            LOGGER.error("Passwordless account [{}] is not allowed to select options", user.getUsername());
            return buildErrorEvent(requestContext);
        }

        val selection = extractSelectedAuthenticationOption(requestContext);
        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {
            LOGGER.warn("Passwordless account [{}] does not require a password", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow delegated authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow multifactor authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        return buildFinalSelectionEvent(requestContext, selection);
    }

    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {
        val finalEvent = switch (selection) {
            case PASSWORD -> {
                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));
                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));

View on GitHub (pinned to e7288fc434)