apereo/cas · error · AccountNotFoundException

Unable to locate registration record for

Error message

Unable to locate registration record for 

What it means

WebAuthnAuthenticationHandler.doAuthentication() looks up registered WebAuthn credentials for the authenticated principal's username via the credential repository. If the user has no registered credential records, it throws AccountNotFoundException — the user cannot perform WebAuthn authentication because no registration exists.

Solutions

1. Complete WebAuthn device registration for the user before attempting WebAuthn authentication
2. Verify the credential repository configuration points to the same storage used during registration (check cas.authn.mfa.webauthn.* backend settings and data contents)
3. Check for username normalization/case differences between the registered record and the authenticating principal id
4. If registrations were lost due to a data reset, re-register devices

Example fix

// before
return createHandlerResult(webAuthnCredential, ...); // throws AccountNotFoundException if unregistered
// after
var creds = webAuthnCredentialRepository.getCredentialIdsForUsername(uid);
if (creds.isEmpty()) {
    throw new AccountNotFoundException("No WebAuthn registration for " + uid + "; register a device first");
}
return createHandlerResult(webAuthnCredential, ...);

boolean registered = !webAuthnCredentialRepository.getCredentialIdsForUsername(principal.getId()).isEmpty();
if (!registered) {
    // route user to registration flow instead of authentication
}

try {
    return handler.authenticate(credential);
} catch (AccountNotFoundException e) {
    // redirect the user to WebAuthn device registration
    return redirectToWebAuthnRegistration(e.getMessage());
}

When it happens

Trigger: Presenting a webauthn credential to the handler when webAuthnCredentialRepository.getCredentialIdsForUsername(uid) returns an empty list — i.e. the username has zero registered authenticators at authentication time.

Common situations: User never completed WebAuthn registration but the webflow allowed credential submission; registration data store changed (different MongoDB/JDBC/Redis backend or database reset) so prior registrations are missing; username mismatch (case or principal id transformation) between registration and authentication; multiple devices out of sync.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• No registration records could be found for
• cannot be found in the registry
• Unauthorized account registration attempt for id
• User already exists
• YubiKey id is not recognized in registry

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/df7852d07f12993e. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-webauthn-core-webflow/src/main/java/org/apereo/cas/webauthn/WebAuthnAuthenticationHandler.java:65

    public boolean supports(final Credential credential) {
        return WebAuthnCredential.class.isAssignableFrom(credential.getClass());
    }

    @Override
    public boolean supports(final Class<? extends Credential> clazz) {
        return WebAuthnCredential.class.isAssignableFrom(clazz);
    }

    @Override
    protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential, final Service service) throws Throwable {
        val webAuthnCredential = (WebAuthnCredential) credential;
        val authentication = Objects.requireNonNull(WebUtils.getInProgressAuthentication(),
            "CAS has no reference to an authentication event to locate a principal");
        val principal = authentication.getPrincipal();
        val uid = principal.getId();
        val credentials = webAuthnCredentialRepository.getCredentialIdsForUsername(principal.getId());
        if (credentials.isEmpty()) {
            throw new AccountNotFoundException("Unable to locate registration record for " + uid);
        }
        return createHandlerResult(webAuthnCredential, this.principalFactory.createPrincipal(uid));
    }
}

View on GitHub (pinned to e7288fc434)