{"record":{"id":"038503b66054de30","repo":"apereo/cas","slug":"no-security-questions-could-be-found-for","errorCode":null,"errorMessage":"No security questions could be found for [{}]","messagePattern":"No security questions could be found for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/VerifyPasswordResetRequestAction.java","lineNumber":64,"sourceCode":"            transientTicket = resetRequest.getPasswordResetTicket().getId();\n        }\n        \n        try {\n            val ticketGrantingTicketId = WebUtils.getTicketGrantingTicketId(requestContext);\n            if (StringUtils.isBlank(transientTicket) && StringUtils.isBlank(ticketGrantingTicketId)) {\n                LOGGER.error(\"Password reset token is missing\");\n                return error();\n            }\n            resetRequest = getPasswordResetRequestFrom(requestContext, transientTicket)\n                .orElseGet(() -> getPasswordResetRequestFrom(ticketGrantingTicketId));\n            Objects.requireNonNull(resetRequest, \"Password reset request cannot be found\");\n            \n            val query = PasswordManagementQuery.builder().username(resetRequest.getUsername()).build();\n            val pm = casProperties.getAuthn().getPm();\n            if (pm.getReset().isSecurityQuestionsEnabled()) {\n                val questions = FunctionUtils.doUnchecked(() -> PasswordManagementService.canonicalizeSecurityQuestions(passwordManagementService.getSecurityQuestions(query)));\n                if (questions.isEmpty()) {\n                    LOGGER.warn(\"No security questions could be found for [{}]\", resetRequest);\n                    return error();\n                }\n                PasswordManagementWebflowUtils.putPasswordResetSecurityQuestions(requestContext, questions);\n            } else {\n                LOGGER.debug(\"Security questions are not enabled for password management\");\n            }\n\n            PasswordManagementWebflowUtils.putPasswordResetRequest(requestContext, resetRequest);\n            PasswordManagementWebflowUtils.putPasswordResetUsername(requestContext, resetRequest.getUsername());\n            PasswordManagementWebflowUtils.putPasswordResetSecurityQuestionsEnabled(requestContext, pm.getReset().isSecurityQuestionsEnabled());\n            \n            if (pm.getReset().isSecurityQuestionsEnabled()) {\n                LOGGER.trace(\"Security questions are enabled; proceeding...\");\n                return success();\n            }\n            return eventFactory.event(this, CasWebflowConstants.TRANSITION_ID_SECURITY_QUESTIONS_DISABLED);\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, \"Password reset token could not be located or verified\", e);","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pm-webflow/src/main/java/org/apereo/cas/pm/web/flow/actions/VerifyPasswordResetRequestAction.java#L46-L82","documentation":"During password reset, the VerifyPasswordResetRequestAction fetches the user's security questions via PasswordManagementService.getSecurityQuestions(query). After canonicalization, if the returned map is empty it logs this warning and returns the error event, aborting the reset flow. It is thrown whenever security questions are enabled in cas.authn.pm.reset.security-questions-enabled but the backing password-management repository has no questions stored for that username.","triggerScenarios":"User submits a password-reset request for an account whose security questions are not configured in the backing store (LDAP/JDBC/etc.); getSecurityQuestions(query) returns an empty map (or a map of null/empty values that canonicalization removes) while securityQuestionsEnabled=true.","commonSituations":"Admins enabled security questions in cas.properties but never populated the questions attribute in the user directory; user accounts provisioned without question/answer attributes; misconfigured attribute mapping so the question attribute name doesn't match; user typo'd their username and reset went to a valid but question-less account.","solutions":["Populate security questions (and answers) for the user in the backing password-management repository (e.g. the LDAP attribute or JDBC table configured under cas.authn.pm).","Verify cas.authn.pm.reset.security-questions-enabled matches reality: set it to false if your deployment doesn't use security questions.","Check the attribute/field mapping in PasswordManagementService configuration so getSecurityQuestions reads the correct attribute name.","Check CAS logs at DEBUG/WARN for the underlying repository lookup to confirm the query reached the store and returned nothing rather than failing."],"exampleFix":"// before (application.properties)\ncas.authn.pm.reset.security-questions-enabled=true\n\n// after: disable if questions are not provisioned\ncas.authn.pm.reset.security-questions-enabled=false","handlingStrategy":"validation","validationCode":"boolean hasSecurityQuestions = pm.getReset().isSecurityQuestionsEnabled()\n    && FunctionUtils.doUnchecked(() -> !PasswordManagementService\n        .canonicalizeSecurityQuestions(passwordManagementService.getSecurityQuestions(query)).isEmpty());","typeGuard":null,"tryCatchPattern":"try {\n    val questions = PasswordManagementService.canonicalizeSecurityQuestions(\n        passwordManagementService.getSecurityQuestions(query));\n    if (questions.isEmpty()) {\n        return alternateResetFlow();\n    }\n} catch (Exception e) {\n    LOGGER.warn(\"Security question lookup failed\", e);\n}","preventionTips":["Keep securityQuestionsEnabled in sync with actual repository provisioning.","Seed security questions during user onboarding.","Monitor this warning as a signal that user data provisioning is incomplete."],"tags":["password-management","security-questions","empty-result","webflow"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}