{"record":{"id":"1f4758188bdb2596","repo":"apereo/cas","slug":"no-authentication-handlers-could-be-resolved-to-su","errorCode":null,"errorMessage":"No authentication handlers could be resolved to support the authentication transaction","messagePattern":"No authentication handlers could be resolved to support the authentication transaction","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"critical","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationEventExecutionPlan.java","lineNumber":199,"sourceCode":"        if (resolvedHandlers.isEmpty()) {\n            LOGGER.debug(\"Authentication handler resolvers produced no candidate authentication handler. Using the default handler resolver instead...\");\n            if (defaultAuthenticationHandlerResolver.supports(handlers, transaction)) {\n                resolvedHandlers.addAll(defaultAuthenticationHandlerResolver.resolve(handlers, transaction));\n            }\n        }\n\n        val byCredential = new ByCredentialSourceAuthenticationHandlerResolver();\n        if (byCredential.supports(resolvedHandlers, transaction)) {\n            val credentialHandlers = byCredential.resolve(resolvedHandlers, transaction);\n            if (!credentialHandlers.isEmpty()) {\n                LOGGER.debug(\"Authentication handlers resolved by credential source are [{}]\", credentialHandlers);\n                resolvedHandlers.removeIf(handler -> !(handler instanceof MultifactorAuthenticationHandler)\n                    && credentialHandlers.stream().noneMatch(credHandler -> Strings.CI.equals(credHandler.getName(), handler.getName())));\n            }\n        }\n\n        if (resolvedHandlers.isEmpty()) {\n            throw new AuthenticationException(\"No authentication handlers could be resolved to support the authentication transaction\");\n        }\n        LOGGER.debug(\"Resolved and finalized authentication handlers to carry out this authentication transaction are [{}]\", handlerResolvers);\n        return resolvedHandlers;\n    }\n\n    @Override\n    public Set<AuthenticationHandler> resolveAuthenticationHandlers() {\n        val clientInfo = ClientInfoHolder.getClientInfo();\n        val handlers = authenticationHandlerPrincipalResolverMap\n            .keySet()\n            .stream()\n            .filter(BeanSupplier::isNotProxy)\n            .filter(handler -> {\n                if (clientInfo != null && StringUtils.isNotBlank(clientInfo.getTenant())) {\n                    val tenantDefinition = tenantExtractor.getTenantsManager().findTenant(clientInfo.getTenant()).orElseThrow();\n                    val authenticationHandlers = tenantDefinition.getAuthenticationPolicy() != null\n                        ? tenantDefinition.getAuthenticationPolicy().getAuthenticationHandlers()\n                        : List.of();","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationEventExecutionPlan.java#L181-L217","documentation":"DefaultAuthenticationEventExecutionPlan.resolveAuthenticationHandlers throws AuthenticationException when, after filtering by credential support (and MFA handling), the resolved handler set is empty — no registered handler can support any credential in the transaction, so authentication cannot proceed.","triggerScenarios":"authenticate() is invoked with credentials for which no handler is registered or eligible: all candidate handlers disabled/removed by MFA resolution, handler names not matching credential handlers, or handlers not registered in the plan at all.","commonSituations":"CAS deployed with no enabled authentication sources (e.g. accept-users and all LDAP/JDBC handlers disabled); misconfigured multifactor policy filtering out all handlers; handler bean missing because its module is not on the classpath.","solutions":["Register/enable at least one authentication handler supporting the submitted credential type (LDAP, JDBC, accept-users, etc.)","Verify handler module dependencies are present and features enabled so beans get created","Check multifactor/authentication policy configuration that may be filtering handlers out by name","Inspect resolved handler logs ('Resolved and finalized authentication handlers') to see what was eligible"],"exampleFix":"// before\ncas.authn.ldap[0].search-filter=(uid={user})  # but LDAP handler feature disabled -> zero handlers\n// after\n# add the LDAP authentication module / enable the feature so the handler bean is registered\ncas.authn.ldap[0].ldap-url=ldaps://ldap.example.org","handlingStrategy":"try-catch","validationCode":"// before authenticating, confirm handlers exist for the credential\nboolean supported = executionPlan.resolveAuthenticationHandlers(transaction).stream()\n    .anyMatch(h -> h.supports(transaction.getCredentials().iterator().next()));","typeGuard":null,"tryCatchPattern":"try {\n    Authentication auth = authenticationManager.authenticate(transaction);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"No authentication handlers could be resolved\")) {\n        LOGGER.error(\"Enable at least one authn handler supporting credential type [{}]\",\n            transaction.getCredentials().iterator().next().getClass().getSimpleName());\n    }\n}","preventionTips":["Keep at least one enabled handler per supported credential type","Verify handler modules/dependencies are on the classpath","Review MFA/policy filters that may exclude all handlers","Check startup logs for registered authentication handlers"],"tags":["java","authentication","handler-resolution"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}