apereo/cas · error · AccountNotFoundException

Unable to find account

Error message

Unable to find account [{}]: The account does not exist or it's missing username/password attributes

What it means

CassandraAuthenticationHandler logs this warning when it cannot authenticate because no usable user record was found: the repository returned null/empty attributes, or the attribute map lacks the configured username or password attribute. It then throws AccountNotFoundException so the credential is treated as unknown-user, not bad-password.

Solutions

  1. Verify the account row exists in the configured keyspace/table (e.g. SELECT * FROM users WHERE username='...').
  2. Check cas.authn.cassandra[0].username-attribute and password-attribute match the actual column names in the table.
  3. Confirm keyspace/contact-point configuration points at the intended Cassandra cluster.
  4. Normalize username case (or lower-case the stored value) to avoid case-sensitivity misses.

Example fix

// before
cas.authn.cassandra[0].username-attribute=login
cas.authn.cassandra[0].password-attribute=secret
// after (matching actual table columns)
cas.authn.cassandra[0].username-attribute=username
cas.authn.cassandra[0].password-attribute=password
Defensive patterns

Strategy: try-catch

Validate before calling

// before authenticating, verify the account row exists
ResultSet rs = session.execute("SELECT " + usernameAttr + ", " + passwordAttr +
  " FROM users WHERE " + usernameAttr + " = ?", username);
if (rs.one() == null) throw new AccountNotFoundException(username);

Type guard

function isValidAccount(attrs: Record<string, string[]> | null, u: string, p: string): attrs is Record<string, string[]> {
  return !!attrs && u in attrs && p in attrs && attrs[p].length > 0;
}

Try / catch

try {
  return cassandraHandler.authenticate(credential);
} catch (AccountNotFoundException e) {
  LOGGER.warn("Unknown user [{}] in Cassandra", credential.getUsername());
  return AuthenticationHandlerResult.failed(credential, e);
}

Prevention

When it happens

Trigger: authenticateUsernamePasswordInternal calls cassandraRepository.getUser(username); the resulting map is null/empty or missing cassandra.authn.username-attribute / password-attribute keys, triggering AccountNotFoundException.

Common situations: Wrong keyspace/table or replica set configured so the user row does not exist; case-mismatched usernames (Cassandra keys are case-sensitive); custom column names not reflected in username-attribute/password-attribute settings; user simply not provisioned.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/66905b2c3d927ba8. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-cassandra-authentication/src/main/java/org/apereo/cas/authentication/CassandraAuthenticationHandler.java:42

    public CassandraAuthenticationHandler(final String name,
                                          final PrincipalFactory principalFactory, final Integer order,
                                          final CassandraAuthenticationProperties cassandraAuthenticationProperties,
                                          final CassandraRepository cassandraRepository) {
        super(name, principalFactory, order);
        this.cassandraAuthenticationProperties = cassandraAuthenticationProperties;
        this.cassandraRepository = cassandraRepository;
    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,
                                                                                        @Nullable final String originalPassword) throws Throwable {
        val username = credential.getUsername();
        val attributes = this.cassandraRepository.getUser(username);

        if (attributes == null || attributes.isEmpty()
            || !attributes.containsKey(cassandraAuthenticationProperties.getUsernameAttribute())
            || !attributes.containsKey(cassandraAuthenticationProperties.getPasswordAttribute())) {
            LOGGER.warn("Unable to find account [{}]: The account does not exist or it's missing username/password attributes", username);
            throw new AccountNotFoundException();
        }

        LOGGER.debug("Located account attributes [{}] for [{}]", attributes.keySet(), username);
        val entryPassword = attributes.get(cassandraAuthenticationProperties.getPasswordAttribute()).getFirst().toString();

        if (!getPasswordEncoder().matches(originalPassword, entryPassword)) {
            LOGGER.warn("Account password on record for [{}] does not match the given password", username);
            throw new FailedLoginException();
        }
        val principal = this.principalFactory.createPrincipal(username, attributes);
        return createHandlerResult(credential, principal, new ArrayList<>());
    }
}

View on GitHub (pinned to e7288fc434)