{"record":{"id":"3b89bb4216e981e1","repo":"apereo/cas","slug":"username-not-found","errorCode":null,"errorMessage":"[username] not found.","messagePattern":"\\[username\\] not found\\.","errorType":"exception","errorClass":"AccountNotFoundException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java","lineNumber":136,"sourceCode":"                                                                                        @Nullable final String originalPassword) throws Throwable {\n        val response = getLdapAuthenticationResponse(upc);\n        LOGGER.debug(\"LDAP response: [{}]\", response);\n        if (!passwordPolicyHandlingStrategy.supports(response)) {\n            LOGGER.warn(\"Authentication has failed because LDAP password policy handling strategy [{}] cannot handle [{}].\",\n                response, passwordPolicyHandlingStrategy.getClass().getSimpleName());\n            throw new FailedLoginException(\"Invalid credentials\");\n        }\n        LOGGER.debug(\"Attempting to examine and handle LDAP password policy via [{}]\",\n            passwordPolicyHandlingStrategy.getClass().getSimpleName());\n        val messageList = passwordPolicyHandlingStrategy.handle(response, getPasswordPolicyConfiguration());\n        if (response.isSuccess()) {\n            LOGGER.debug(\"LDAP response returned a result [{}], creating the final LDAP principal\", response.getLdapEntry());\n            val principal = createPrincipal(upc.getUsername(), response.getLdapEntry());\n            return createHandlerResult(upc, principal, messageList);\n        }\n        if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {\n            LOGGER.warn(\"DN resolution failed. [{}]\", response.getDiagnosticMessage());\n            throw new AccountNotFoundException(upc.getUsername() + \" not found.\");\n        }\n        throw new FailedLoginException(\"Invalid credentials\");\n    }\n\n    /**\n     * Creates a CAS principal with attributes if the LDAP entry contains principal attributes.\n     *\n     * @param username  Username that was successfully authenticated which is used for principal ID when principal id is not specified.\n     * @param ldapEntry LDAP entry that may contain principal attributes.\n     * @return Principal if the LDAP entry contains at least a principal ID attribute value.\n     * @throws LoginException On security policy errors related to principal creation.\n     */\n    protected @Nullable Principal createPrincipal(final String username, final LdapEntry ldapEntry) throws Throwable {\n        LOGGER.debug(\"Creating LDAP principal for [{}] based on [{}] and attributes [{}]\", username, ldapEntry.getDn(),\n            ldapEntry.getAttributeNames());\n        val id = getLdapPrincipalIdentifier(username, ldapEntry);\n        LOGGER.debug(\"LDAP principal identifier created is [{}]\", id);\n        val attributeMap = collectAttributesForLdapEntry(ldapEntry, id);","sourceCodeStart":118,"sourceCodeEnd":154,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java#L118-L154","documentation":"When the ldaptive AuthenticationResultCode is DN_RESOLUTION_FAILURE, the LDAP server could not resolve the distinguished name for the supplied username, so the entry was never found. The handler throws AccountNotFoundException '<username> not found.'","triggerScenarios":"With search-based auth, the search filter/baseDn yields no entry for the username; with direct DN auth, the constructed DN template does not exist in the directory.","commonSituations":"Wrong baseDn or userFilter (e.g. (uid={user}) but the attribute is sAMAccountName); DN template mismatch like cn={0},ou=people,dc=example,dc=org; user actually not provisioned; user disabled/moved in AD.","solutions":["Verify userFilter and baseDn match the directory schema; test with ldapsearch.","If using DN templates, correct the dnFormat to the real DN structure.","Confirm the account exists and is in the searched OU; provision or move the user.","Check that search-subtree is enabled if users live in nested OUs."],"exampleFix":"// before\ncas.authn.ldap[0].user-filter=(uid={user})\ncas.authn.ldap[0].base-dn=ou=people,dc=example,dc=org\n// after (AD)\ncas.authn.ldap[0].user-filter=(sAMAccountName={user})\ncas.authn.ldap[0].base-dn=dc=example,dc=org\ncas.authn.ldap[0].search-subtree=true","handlingStrategy":"validation","validationCode":"// pre-flight: can the directory resolve this user?\nSearchResult sr = connectionFactory.search(\n  new SearchRequest(baseDn, userFilter.replace(\"{user}\", username), \"dn\"));\nif (sr.getResult() == null) { throw new AccountNotFoundException(username); }","typeGuard":null,"tryCatchPattern":"try { result = handler.authenticate(credential); }\ncatch (AccountNotFoundException e) { log.warn(\"No DN resolved for {}\", username); showUnknownUserMessage(); }","preventionTips":["Test userFilter and baseDn with ldapsearch before wiring them into CAS.","Enable subtree search for nested OUs.","Keep DN templates synchronized with the directory's real structure."],"tags":["ldap","dn-resolution","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}