{"record":{"id":"2f1c55baf3265b4e","repo":"apereo/cas","slug":"no-registration-records-could-be-found-for","errorCode":null,"errorMessage":"No registration records could be found for [{}]","messagePattern":"No registration records could be found for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-webauthn-core-webflow/src/main/java/org/apereo/cas/webauthn/web/flow/WebAuthnStartAuthenticationAction.java","lineNumber":50,"sourceCode":" */\n@RequiredArgsConstructor\n@Getter\n@Slf4j\npublic class WebAuthnStartAuthenticationAction extends AbstractMultifactorAuthenticationAction<WebAuthnMultifactorAuthenticationProvider> {\n    protected final CasConfigurationProperties casProperties;\n    protected final TicketRegistry ticketRegistry;\n    protected final TicketFactory ticketFactory;\n    protected final RegistrationStorage webAuthnCredentialRepository;\n    protected final TenantExtractor tenantExtractor;\n    \n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val authentication = WebUtils.getAuthentication(requestContext);\n        val principal = resolvePrincipal(authentication.getPrincipal(), requestContext);\n        LOGGER.trace(\"Checking registration record for [{}]\", principal.getId());\n        val registrations = webAuthnCredentialRepository.getRegistrationsByUsername(principal.getId());\n        if (registrations.isEmpty()) {\n            LOGGER.warn(\"No registration records could be found for [{}]\", principal.getId());\n            return error();\n        }\n\n        if (casProperties.getAuthn().getMfa().getWebAuthn().getCore().isQrCodeAuthenticationEnabled()) {\n            val transientFactory = (TransientSessionTicketFactory) ticketFactory.get(TransientSessionTicket.class);\n            val ticket = transientFactory.create(Map.of(Principal.class.getName(), principal));\n            val storedTicket = ticketRegistry.addTicket(ticket);\n            val urlBuilder = new URIBuilder(casProperties.getServer().getPrefix());\n            urlBuilder.appendPath(BaseWebAuthnController.BASE_ENDPOINT_WEBAUTHN);\n            urlBuilder.appendPath(WebAuthnQRCodeController.ENDPOINT_QR_VERIFY);\n            requestContext.getFlowScope().put(\"QRCodeUri\", urlBuilder.toString());\n            urlBuilder.appendPath(storedTicket.getId());\n            val qrCodeBase64 = QRUtils.generateQRCode(urlBuilder.toString(), QRUtils.SIZE, QRUtils.SIZE);\n            requestContext.getFlowScope().put(\"QRCode\", qrCodeBase64);\n            requestContext.getFlowScope().put(\"QRCodeTicket\", storedTicket);\n            WebUtils.putPrincipal(requestContext, principal);\n        }\n","sourceCodeStart":32,"sourceCodeEnd":68,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-webauthn-core-webflow/src/main/java/org/apereo/cas/webauthn/web/flow/WebAuthnStartAuthenticationAction.java#L32-L68","documentation":"WebAuthnStartAuthenticationAction checks whether the authenticated principal has any WebAuthn credential registrations via webAuthnCredentialRepository.getRegistrationsByUsername. If none exist it logs this warning and returns the error event, blocking WebAuthn MFA because a user with no registered authenticator cannot perform WebAuthn authentication.","triggerScenarios":"A user forced into WebAuthn MFA (required authentication method or per-service policy) who has never completed device registration; the repository (account store/registry) lookup returns an empty registration list for the principal id.","commonSituations":"New users onboarded with WebAuthn MFA set to required before registering a device; user renamed so the username no longer matches registration records; WebAuthn registration storage wiped or pointing at a different backend; registration records stored under a different principal id casing.","solutions":["Have the user complete WebAuthn device registration first (trigger the registration flow) before authentication.","Set cas.authn.mfa.webauthn.core.enabled or the MFA trigger policy so unregistered users are routed to registration instead of hard-failing (e.g. use a WebAuthn MFA trigger that accounts for registration state).","Verify the repository backend holds registrations for that exact username (check casing and attribute resolution).","Confirm the configured webAuthnCredentialRepository points at the same store used during registration."],"exampleFix":"// before: WebAuthn required for everyone, unregistered users fail\n// after: allow fallback / route unregistered users to registration\nweathermap: configure cas.authn.mfa.webauthn.core.location-policy / trigger groovy to check registrations before forcing webauthn","handlingStrategy":"validation","validationCode":"boolean registered = !webAuthnCredentialRepository.getRegistrationsByUsername(principal.getId()).isEmpty();\nif (!registered) {\n    routeToWebAuthnRegistration();\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure MFA triggers to check registration state before forcing WebAuthn.","Run user onboarding that includes WebAuthn device registration.","Keep principal id resolution consistent between registration and authentication.","Point registration and authentication at the same credential repository store."],"tags":["webauthn","mfa","registration","webflow"],"backgroundTag":"record-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}