apereo/cas · error · FailedLoginException

[username] not found with SQL query.

Error message

[username] not found with SQL query.

What it means

SearchModeSearchDatabaseAuthenticationHandler authenticates by issuing a SELECT COUNT(*) WHERE username=? AND password=?. If the count is null or zero, no matching row exists and FailedLoginException 'not found with SQL query' is thrown.

Solutions

1. Confirm username/password are correct for the target table.
2. Align cas.authn.jdbc.search[].passwordEncoder/encryptionAlgorithm with how passwords are actually stored in the column.
3. Log and run the generated SQL manually to see which predicate fails.
4. Check fieldUser/fieldPassword properties point at real columns in the configured table.

Example fix

// before: comparing raw password against md5-hashed column
cas.authn.jdbc.search[0].fieldPassword=password
// after: use the encoder matching storage
cas.authn.jdbc.search[0].passwordEncoder.type=DEFAULT
cas.authn.jdbc.search[0].passwordEncoder.characterEncoding=UTF-8
cas.authn.jdbc.search[0].passwordEncoder.encodingAlgorithm=MD5

// Verify a row exists with the expected password scheme before auth
Integer n = jdbcTemplate.queryForObject(
  "SELECT COUNT(*) FROM users WHERE username=?", Integer.class, username);
if (n == null || n == 0) { throw new AccountNotFoundException(username); }

try { result = handler.authenticate(credential); }
catch (FailedLoginException e) { log.warn("Search-mode auth failed for user: {}", credential.getUsername()); return genericAuthError(); }

When it happens

Trigger: authenticateUsernamePasswordInternal runs the generated count query with (username, password); queryForObject returns 0/null because either the username is absent or the stored password hash does not match the supplied password.

Common situations: Wrong password; cas.authn.jdbc.search[].fieldPassword storing plaintext while CAS compares a hash (or vice versa, depending on passwordEncoder config); username case mismatch; wrong table.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• [username] not found with SQL query
• not found in backing map.
• not found in backing file.
• [e.getMessage()]
• Password does not match value on record.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/d7fa47bac25449ed. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-jdbc-authentication/src/main/java/org/apereo/cas/jdbc/SearchModeSearchDatabaseAuthenticationHandler.java:48

                                                         final PrincipalFactory principalFactory,
                                                         final DataSource datasource) {
        super(properties, principalFactory, datasource);
    }

    @Override
    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(
        final UsernamePasswordCredential credential, final String originalPassword) throws Throwable {
        val sql = "SELECT COUNT('x') FROM ".concat(properties.getTableUsers())
            .concat(" WHERE ")
            .concat(properties.getFieldUser())
            .concat(" = ? AND ")
            .concat(properties.getFieldPassword()).concat("= ?");
        val username = credential.getUsername();
        try {
            LOGGER.debug("Executing SQL query [{}]", sql);
            val count = getJdbcTemplate().queryForObject(sql, Integer.class, username, credential.toPassword());
            if (count == null || count == 0) {
                throw new FailedLoginException(username + " not found with SQL query.");
            }
            val principal = principalFactory.createPrincipal(username);
            return createHandlerResult(credential, principal, new ArrayList<>());
        } catch (final Throwable e) {
            LoggingUtils.error(LOGGER, e);
            throw new FailedLoginException(e.getMessage());
        }
    }
}

View on GitHub (pinned to e7288fc434)