{"record":{"id":"42c0e8130410f152","repo":"apereo/cas","slug":"authentication-cannot-find-attribute-to-use-a","errorCode":null,"errorMessage":"Authentication cannot find attribute [{}] to use as principal id","messagePattern":"Authentication cannot find attribute \\[(.+?)\\] to use as principal id","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java","lineNumber":119,"sourceCode":"                                                          final Service service) throws Throwable {\n    }\n\n    protected String determinePrincipalIdFrom(final UserProfile profile, final BaseClient client) {\n        var id = profile.getId();\n        val properties = client != null ? client.getCustomProperties() : new HashMap<>();\n        if (client != null && properties.containsKey(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID)) {\n            val attrObject = properties.get(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID);\n            if (attrObject != null) {\n                val principalAttribute = attrObject.toString();\n                if (profile.containsAttribute(principalAttribute)) {\n                    val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttribute));\n                    if (firstAttribute.isPresent()) {\n                        id = firstAttribute.get().toString();\n                        id = typePrincipalId(id, profile);\n                    }\n                    LOGGER.debug(\"Authentication indicates usage of client principal attribute [{}] for the identifier [{}]\", principalAttribute, id);\n                } else {\n                    LOGGER.warn(\"Authentication cannot find attribute [{}] to use as principal id\", principalAttribute);\n                }\n            } else {\n                LOGGER.warn(\"No custom principal attribute was provided by the client [{}]. Using the default id [{}]\", client, id);\n            }\n        } else if (StringUtils.isNotBlank(principalAttributeId)) {\n            if (profile.containsAttribute(principalAttributeId)) {\n                val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttributeId));\n                if (firstAttribute.isPresent()) {\n                    id = firstAttribute.get().toString();\n                    id = typePrincipalId(id, profile);\n                }\n            } else {\n                LOGGER.warn(\"CAS cannot use [{}] as the principal attribute id, since the profile attributes do not contain the attribute. \"\n                    + \"Either adjust the CAS configuration to use a different attribute, or contact the authentication provider noted by [{}] \"\n                    + \"to release the expected attribute to CAS\", principalAttributeId, profile.getAttributes());\n            }\n            LOGGER.debug(\"Authentication indicates usage of attribute [{}] for the identifier [{}]\", principalAttributeId, id);\n        } else if (isTypedIdUsed) {","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java#L101-L137","documentation":"BaseDelegatedClientAuthenticationHandler.determinePrincipalIdFrom warns when a per-client principal attribute (client config principal-attribute name) was configured, but the authenticated pac4j user profile does not contain that attribute, so the attribute cannot be used as the principal id. CAS continues with the profile's default identifier.","triggerScenarios":"Delegated client configuration (cas.authn.pac4j.<client>.principal-attribute-id / client principalAttribute) names an attribute, profile.containsAttribute(...) is false after provider authentication, i.e. the provider did not release that attribute.","commonSituations":"OIDC/OAuth providers not asked for or not returning the configured attribute (missing scope/claim mapping); attribute renamed on the provider side; typo in configured attribute name; SAML providers not releasing the attribute.","solutions":["Request/release the attribute from the provider (add the scope/claim, e.g. cas.authn.pac4j.oidc[0].scope=openid profile email, or configure SAML attribute release).","Correct the configured principal attribute name to one actually present in the provider profile.","Remove the principal-attribute setting so CAS falls back to the default profile id intentionally."],"exampleFix":"// before\ncas.authn.pac4j.oidc[0].principal-attribute-id=userPrincipalName\n// after (attribute the IdP actually releases)\ncas.authn.pac4j.oidc[0].principal-attribute-id=email","handlingStrategy":"validation","validationCode":"// after authentication, before using the attribute\nif (StringUtils.isNotBlank(principalAttribute) && !profile.containsAttribute(principalAttribute)) {\n    logger.warn(\"Provider did not release [{}]; falling back to default id\", principalAttribute);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify attribute release with the provider (scopes/claims/SAML filtering) before configuring principal attributes.","Log profile.getAttributes() once in a test environment to confirm attribute names."],"tags":["pac4j","delegated-authentication","principal-attribute","attribute-release"],"backgroundTag":"attribute-not-released","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}