apereo/cas · error · AccountNotFoundException

[username] not found.

Error message

[username] not found.

What it means

When the ldaptive AuthenticationResultCode is DN_RESOLUTION_FAILURE, the LDAP server could not resolve the distinguished name for the supplied username, so the entry was never found. The handler throws AccountNotFoundException '<username> not found.'

Solutions

1. Verify userFilter and baseDn match the directory schema; test with ldapsearch.
2. If using DN templates, correct the dnFormat to the real DN structure.
3. Confirm the account exists and is in the searched OU; provision or move the user.
4. Check that search-subtree is enabled if users live in nested OUs.

Example fix

// before
cas.authn.ldap[0].user-filter=(uid={user})
cas.authn.ldap[0].base-dn=ou=people,dc=example,dc=org
// after (AD)
cas.authn.ldap[0].user-filter=(sAMAccountName={user})
cas.authn.ldap[0].base-dn=dc=example,dc=org
cas.authn.ldap[0].search-subtree=true

// pre-flight: can the directory resolve this user?
SearchResult sr = connectionFactory.search(
  new SearchRequest(baseDn, userFilter.replace("{user}", username), "dn"));
if (sr.getResult() == null) { throw new AccountNotFoundException(username); }

try { result = handler.authenticate(credential); }
catch (AccountNotFoundException e) { log.warn("No DN resolved for {}", username); showUnknownUserMessage(); }

When it happens

Trigger: With search-based auth, the search filter/baseDn yields no entry for the username; with direct DN auth, the constructed DN template does not exist in the directory.

Common situations: Wrong baseDn or userFilter (e.g. (uid={user}) but the attribute is sAMAccountName); DN template mismatch like cn={0},ou=people,dc=example,dc=org; user actually not provisioned; user disabled/moved in AD.

Understand the failure class

Background: "User not found", "Invalid user", and "does not exist": what missing-user lookup errors mean across Rocket.Chat, LiteLLM, Phabricator, rustfs, and pnpm — this error's family across 10 libraries.

Related errors

• DN resolution failed.
• not found in backing map.
• not found in backing file.
• [username] not found with SQL query
• [username] not found with SQL query.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/3b89bb4216e981e1. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java:136

                                                                                        @Nullable final String originalPassword) throws Throwable {
        val response = getLdapAuthenticationResponse(upc);
        LOGGER.debug("LDAP response: [{}]", response);
        if (!passwordPolicyHandlingStrategy.supports(response)) {
            LOGGER.warn("Authentication has failed because LDAP password policy handling strategy [{}] cannot handle [{}].",
                response, passwordPolicyHandlingStrategy.getClass().getSimpleName());
            throw new FailedLoginException("Invalid credentials");
        }
        LOGGER.debug("Attempting to examine and handle LDAP password policy via [{}]",
            passwordPolicyHandlingStrategy.getClass().getSimpleName());
        val messageList = passwordPolicyHandlingStrategy.handle(response, getPasswordPolicyConfiguration());
        if (response.isSuccess()) {
            LOGGER.debug("LDAP response returned a result [{}], creating the final LDAP principal", response.getLdapEntry());
            val principal = createPrincipal(upc.getUsername(), response.getLdapEntry());
            return createHandlerResult(upc, principal, messageList);
        }
        if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {
            LOGGER.warn("DN resolution failed. [{}]", response.getDiagnosticMessage());
            throw new AccountNotFoundException(upc.getUsername() + " not found.");
        }
        throw new FailedLoginException("Invalid credentials");
    }

    /**
     * Creates a CAS principal with attributes if the LDAP entry contains principal attributes.
     *
     * @param username  Username that was successfully authenticated which is used for principal ID when principal id is not specified.
     * @param ldapEntry LDAP entry that may contain principal attributes.
     * @return Principal if the LDAP entry contains at least a principal ID attribute value.
     * @throws LoginException On security policy errors related to principal creation.
     */
    protected @Nullable Principal createPrincipal(final String username, final LdapEntry ldapEntry) throws Throwable {
        LOGGER.debug("Creating LDAP principal for [{}] based on [{}] and attributes [{}]", username, ldapEntry.getDn(),
            ldapEntry.getAttributeNames());
        val id = getLdapPrincipalIdentifier(username, ldapEntry);
        LOGGER.debug("LDAP principal identifier created is [{}]", id);
        val attributeMap = collectAttributesForLdapEntry(ldapEntry, id);

View on GitHub (pinned to e7288fc434)