apereo/cas · error · AccountNotFoundException

not found in backing map.

Error message

${username} not found in backing map.

What it means

AcceptUsersAuthenticationHandler throws AccountNotFoundException when the submitted username is not a key in its configured users map. Unlike a password failure, this reports that the account does not exist in the static backing map at all.

Solutions

  1. Add the user to cas.authn.accept.users in the form username::password
  2. Check exact spelling and case of the submitted username
  3. If users should come from a directory, migrate from the static handler to LDAP/JDBC authentication

Example fix

// before
cas.authn.accept.users=casuser::Mellon  # user 'alice' not listed
// after
cas.authn.accept.users=casuser::Mellon|alice::alicePassword
Defensive patterns

Strategy: validation

Validate before calling

// before submitting credentials
boolean known = casProperties.getAuthn().getAccept().getUsers().keySet().stream()
    .anyMatch(u -> u.equals(submittedUsername));
if (!known) { throw new IllegalArgumentException("Username not provisioned in accept-users map"); }

Try / catch

try {
    handlerResult = acceptUsersHandler.authenticate(credential, service);
} catch (AccountNotFoundException e) {
    LOGGER.warn("Unknown user [{}] for static handler", credential.getUsername());
}

Prevention

When it happens

Trigger: authenticateUsernamePasswordInternal is called with a username absent from the users map loaded from cas.authn.accept.users (or the bean's map), e.g. typo in username, case-sensitive mismatch, or user never provisioned in the property.

Common situations: End users typing usernames not present in the static list; case sensitivity differences (map keys are exact); environments where the static user list is out of date versus the real user directory.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/fbc88e1203dea09e. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java:67

                                            final PrincipalFactory principalFactory, final Integer order,
                                            final Map<String, String> users) {
        super(name, principalFactory, order);
        this.users = users;
    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(
        final UsernamePasswordCredential credential,
        @Nullable final String originalPassword) throws Throwable {

        if (this.users == null || this.users.isEmpty()) {
            throw new FailedLoginException("No user can be accepted because none is defined");
        }
        val username = credential.getUsername();
        val cachedPassword = this.users.get(username);
        if (cachedPassword == null) {
            LOGGER.debug("[{}] was not found in the map.", username);
            throw new AccountNotFoundException(username + " not found in backing map.");
        }
        if (!Strings.CS.equals(credential.toPassword(), cachedPassword)) {
            throw new FailedLoginException();
        }
        val strategy = getPasswordPolicyHandlingStrategy();
        if (strategy != null && StringUtils.isNotBlank(username)) {
            LOGGER.debug("Attempting to examine and handle password policy via [{}]", strategy.getClass().getSimpleName());
            val principal = this.principalFactory.createPrincipal(username);
            val messageList = strategy.handle(principal, getPasswordPolicyConfiguration());
            return createHandlerResult(credential, principal, messageList);
        }
        throw new FailedLoginException("Unable to authenticate " + credential.getId());
    }
}

View on GitHub (pinned to e7288fc434)