apereo/cas · error · AccountNotFoundException

Unable to find account

Error message

Unable to find account [{}]: The account does not exist or it's missing username/password attributes

What it means

AmazonCloudDirectoryAuthenticationHandler logs this warning when the AWS Cloud Directory user lookup returns null/empty attributes or lacks the configured username/password attribute names, so authentication cannot proceed and AccountNotFoundException is thrown.

Solutions

Confirm the user exists in the AWS Cloud Directory at the configured directory path.
Check username-attribute and password-attribute names match the Cloud Directory facet attributes exactly.
Verify the directory ARN and schema configuration in cas.authn.cloud-directory properties.
Ensure the AWS credentials/IAM policy allow reading objects and facet attributes from the directory.

Example fix

// before
cas.authn.cloud-directory.username-attribute=name
// after (matches facet attribute)
cas.authn.cloud-directory.username-attribute=UserName
cas.authn.cloud-directory.password-attribute=Password

Defensive patterns

Strategy: try-catch

Validate before calling

// before authenticating, verify user attributes via CloudDirectory API
ListObjectsRequest req = ...; // path to user
if (lookupUser(username) == null) throw new AccountNotFoundException(username);

Type guard

function hasRequiredAttributes(attrs: Record<string, string[]> | null, u: string, p: string): attrs is Record<string, string[]> {
  return !!attrs && u in attrs && p in attrs;
}

Try / catch

try {
  return cloudDirectoryHandler.authenticate(credential);
} catch (AccountNotFoundException e) {
  LOGGER.warn("Unknown user [{}] in Cloud Directory", credential.getUsername());
  return AuthenticationHandlerResult.failed(credential, e);
}

Prevention

Verify attribute names in cas.authn.cloud-directory match the Cloud Directory facet schema.
Confirm the directory ARN/path and AWS credentials/IAM read permissions.
Provision test users and assert lookup succeeds before go-live.
Watch Cloud Directory API errors/metrics for silent lookup failures.

When it happens

Trigger: authenticateUsernamePasswordInternal calls repository.getUser(username); attributes are null/empty or missing cloud-directory username-attribute / password-attribute keys, producing AccountNotFoundException.

Common situations: User not present in the configured Cloud Directory schema/facet; attribute names in cas.authn.amazon-cloud-directory do not match the actual facet attribute names; wrong directory ARN or path configured; IAM permissions silently limiting lookup results.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e1f2de9412c84313. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java:45

                                                     final AmazonCloudDirectoryRepository repository,
                                                     final AmazonCloudDirectoryProperties cloudDirectoryProperties) {
        super(name, principalFactory, cloudDirectoryProperties.getOrder());
        this.repository = repository;
        this.cloudDirectoryProperties = cloudDirectoryProperties;
    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,
                                                                                        @Nullable final String originalPassword) throws Throwable {

        val username = credential.getUsername();

        val attributes = repository.getUser(username);

        if (attributes == null || attributes.isEmpty()
            || !attributes.containsKey(cloudDirectoryProperties.getUsernameAttributeName())
            || !attributes.containsKey(cloudDirectoryProperties.getPasswordAttributeName())) {
            LOGGER.warn("Unable to find account [{}]: The account does not exist or it's missing username/password attributes", username);
            throw new AccountNotFoundException();
        }

        LOGGER.debug("Located account attributes [{}] for [{}]", attributes.keySet(), username);

        val userPassword = attributes.get(cloudDirectoryProperties.getPasswordAttributeName()).getFirst().toString();
        if (!matches(Objects.requireNonNull(originalPassword), userPassword)) {
            LOGGER.warn("Account password on record for [{}] does not match the given/encoded password", username);
            throw new FailedLoginException();
        }
        val principal = this.principalFactory.createPrincipal(username, attributes);
        return createHandlerResult(credential, principal, new ArrayList<>());
    }
}

View on GitHub (pinned to e7288fc434)