apereo/cas · error · AccountNotFoundException

Unable to locate user account

Error message

Unable to locate user account

What it means

MongoDbAuthenticationHandler throws AccountNotFoundException when the Mongo collection query (username-attribute equals the transformed username) returns no documents. This distinguishes 'unknown user' from 'wrong password' so CAS policies such as account throttling or lockout can react accordingly.

Solutions

1. Verify the user document exists: db.<collection>.findOne({<usernameAttribute>: '<entered username>'})
2. Check cas.authn.mongo[0].collection, database, and username-attribute point at the right collection and field
3. Watch for case/format differences; align cas.authn.mongo[0].credential-criteria/transformation with how usernames are stored
4. Provision the user account if it genuinely does not exist

Example fix

// config before
cas.authn.mongo[0].username-attribute=username

// after  (when docs store logins in the email field)
cas.authn.mongo[0].username-attribute=email

// probe user existence before auth flow in admin tooling
boolean exists = mongoTemplate.getCollection(collection)
    .find(Filters.eq(usernameAttr, username)).iterator().hasNext();

try {
    return handler.authenticate(transaction);
} catch (AccountNotFoundException e) {
    logger.info("Unknown user attempted login: {}", transaction.getCredential().getId());
    throw new UnknownUsernameAuthenticationException();
} catch (FailedLoginException e) {
    throw new BadCredentialsAuthenticationException();
}

When it happens

Trigger: authenticateUsernamePasswordInternal: collection.find(Filters.eq(usernameAttribute, username)) has no next() result — the username does not exist in the configured collection, or the query matches nothing due to attribute/collection misconfiguration.

Common situations: User not yet provisioned into the Mongo users collection; case sensitivity (Mongo queries are case-sensitive) causing 'Alice' vs 'alice' miss; wrong collection or database configured; username-attribute mismatch (e.g. docs use 'email' but config says 'username'); credential transformation (e.g. lowercasing) changing the id.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• not found in backing map.
• not found in backing file.
• [username] not found with SQL query.
• No password attribute found for
• Could not locate account for

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/690af8e36a572e43. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-mongo/src/main/java/org/apereo/cas/authentication/MongoDbAuthenticationHandler.java:62

                if (!result.containsKey(properties.getPasswordAttribute())) {
                    throw new FailedLoginException("No password attribute found for " + transformedCredential.getId());
                }

                val entryPassword = result.get(properties.getPasswordAttribute());
                if (!getPasswordEncoder().matches(originalPassword, entryPassword.toString())) {
                    LOGGER.warn("Account password on record for [{}] does not match the given/encoded password", transformedCredential.getId());
                    throw new FailedLoginException();
                }
                val attributes = result
                    .entrySet()
                    .stream()
                    .filter(entry -> !entry.getKey().equals(properties.getPasswordAttribute()) && !entry.getKey().equals(properties.getUsernameAttribute()))
                    .collect(Collectors.toMap(Map.Entry::getKey,
                        entry -> CollectionUtils.toCollection(entry.getValue(), ArrayList.class), (__, b) -> b, () -> new HashMap<String, List<Object>>()));
                val principal = this.principalFactory.createPrincipal(transformedCredential.getId(), attributes);
                return createHandlerResult(transformedCredential, principal, new ArrayList<>());
            }
            throw new AccountNotFoundException("Unable to locate user account");
        }
    }
}

View on GitHub (pinned to e7288fc434)