apereo/cas · warning

Provided credentials chain is empty as no credentials have…

Error message

Provided credentials chain is empty as no credentials have been collected

What it means

DefaultAuthenticationResultBuilder.getInitialCredential logs a warning when the provided credentials collection is empty, then returns Optional.empty(). It mirrors error 364 but for credentials rather than authentications.

Solutions

1. Populate the builder with the initial credential(s) from the authentication transaction before reading them back.
2. Check the webflow state that captures credentials executed (submit/initial flow actions).
3. Handle Optional.empty() defensively when the initial credential is legitimately optional in your flow.

Example fix

// before
val cred = resultBuilder.getInitialCredential(); // empty
// after
resultBuilder.collect(transaction.getCredentials());
val cred = resultBuilder.getInitialCredential();

if (resultBuilder.getInitialCredential().isEmpty()) {
    // credentials never captured — send user back to the credential step
}

Optional<Credential> maybeCred = resultBuilder.getInitialCredential();
if (maybeCred.isPresent()) {
    Credential c = maybeCred.get();
    // safe use
}

When it happens

Trigger: getInitialCredential() called on a builder whose providedCredentials were never populated (transaction submission path never called collect/credential capture).

Common situations: Custom webflow actions constructing AuthenticationResultBuilder manually; flows re-entered after credential capture step was skipped; tests instantiating DefaultAuthenticationResultBuilder without credentials.

Understand the failure class

Background: EmptyResultError / "no results found": when an API or scraper succeeds but returns zero rows — this error's family across 9 libraries.

Related errors

• Resolved credentials for this transaction are empty
• No credentials can be extracted to authenticate the REST…
• Unable to extract credentials for multifactor authentication
• No credentials are provided or extracted to authenticate…
• [ ] Caused by: [ ]

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/a8bd47e385657765. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationResultBuilder.java:59

                                                 final Map<String, List<Object>> principalAttributes) throws Throwable {
        return principalElectionStrategy.nominate(new LinkedHashSet<>(authentications), principalAttributes);
    }

    @Override
    public Optional<Authentication> getInitialAuthentication() {
        if (this.authentications.isEmpty()) {
            LOGGER.warn("Authentication chain is empty as no authentications have been collected");
        }

        synchronized (this.authentications) {
            return this.authentications.stream().findFirst();
        }
    }

    @Override
    public Optional<Credential> getInitialCredential() {
        if (this.providedCredentials.isEmpty()) {
            LOGGER.warn("Provided credentials chain is empty as no credentials have been collected");
        }
        return providedCredentials.stream().findFirst();
    }

    @Override
    @CanIgnoreReturnValue
    public AuthenticationResultBuilder collect(final Authentication authentication) {
        Optional.ofNullable(authentication).ifPresent(authentications::add);
        return this;
    }

    @Override
    @CanIgnoreReturnValue
    public AuthenticationResultBuilder collect(final Collection<Authentication> authentications) {
        this.authentications.addAll(authentications);
        return this;
    }

View on GitHub (pinned to e7288fc434)