{"record":{"id":"445eae4d2fc70b7d","repo":"apereo/cas","slug":"ldap-response-is-not-found-or-does-not-contain-a-r","errorCode":null,"errorMessage":"LDAP response is not found or does not contain a result entry for [{}]","messagePattern":"LDAP response is not found or does not contain a result entry for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-surrogate-authentication-ldap/src/main/java/org/apereo/cas/authentication/surrogate/SurrogateLdapAuthenticationService.java","lineNumber":75,"sourceCode":"                LoggingUtils.error(LOGGER, e);\n            }\n        }\n        return false;\n    }\n\n    @Override\n    public Collection<String> getImpersonationAccounts(final String username, final Optional<? extends Service> service) {\n        val ldapProperties = casProperties.getAuthn().getSurrogate().getLdap();\n        for (val ldap : ldapProperties) {\n            try (val connectionFactory = new LdapConnectionFactory(LdapUtils.newLdaptiveConnectionFactory(ldap))) {\n                val filter = LdapUtils.newLdaptiveSearchFilter(ldap.getSearchFilter(), CollectionUtils.wrap(username));\n                LOGGER.debug(\"Using search filter to find eligible accounts: [{}]\", filter);\n\n                val response = connectionFactory.executeSearchOperation(ldap.getBaseDn(), filter, ldap.getPageSize());\n                LOGGER.debug(\"LDAP response: [{}]\", response);\n\n                if (!LdapUtils.containsResultEntry(response)) {\n                    LOGGER.warn(\"LDAP response is not found or does not contain a result entry for [{}]\", username);\n                    return new ArrayList<>();\n                }\n\n                val ldapEntry = response.getEntry();\n                val attribute = ldapEntry.getAttribute(ldap.getMemberAttributeName());\n                LOGGER.debug(\"Locating LDAP entry [{}] with attribute [{}]\", ldapEntry, attribute);\n\n                if (attribute == null || attribute.getStringValues().isEmpty()) {\n                    LOGGER.warn(\"Attribute [{}] not found or has no values\", ldap.getMemberAttributeName());\n                    return new ArrayList<>();\n                }\n\n                val pattern = RegexUtils.createPattern(ldap.getMemberAttributeValueRegex());\n                LOGGER.debug(\"Constructed attribute value regex pattern [{}]\", pattern.pattern());\n                val eligible = attribute.getStringValues()\n                    .stream()\n                    .map(pattern::matcher)\n                    .filter(Matcher::matches)","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-surrogate-authentication-ldap/src/main/java/org/apereo/cas/authentication/surrogate/SurrogateLdapAuthenticationService.java#L57-L93","documentation":"SurrogateLdapAuthenticationService searches LDAP for the acting user's entry to read the member attribute listing impersonatable accounts. When the search response contains no entry (no match or search failure surfaced as empty response), it logs this warning and returns an empty account list, meaning surrogate (impersonation) login will be denied for that user.","triggerScenarios":"getImpersonationAccounts executes a search with the configured baseDn and surrogate-enabled filter, and LdapUtils.containsResultEntry(response) is false - the user DN is outside baseDn, the filter matches nothing, or the entry lacks object visibility to the bind account.","commonSituations":"Wrong surrogate search base DN or search filter in cas.authn.surrogate.ldap[...]; user attribute (e.g. surrogateMemberOf not populated in LDAP); bind account lacking read rights on the entry; searching the wrong LDAP branch after an org restructure.","solutions":["Verify base-dn and search-filter in cas.authn.surrogate.ldap config actually contain the target user.","Run the same filter with ldapsearch using the CAS bind credentials to see whether an entry returns.","Confirm the user's LDAP entry carries the expected member attribute / surrogate authorization data.","Check bind DN permissions can read the user entry under the configured base."],"exampleFix":"// before\ncas.authn.surrogate.ldap[0].base-dn=ou=people,dc=example,dc=org\ncas.authn.surrogate.ldap[0].search-filter=(uid={user})\n// after  # uid replaced with sAMAccountName to match directory schema\ncas.authn.surrogate.ldap[0].base-dn=ou=people,dc=example,dc=org\ncas.authn.surrogate.ldap[0].search-filter=(sAMAccountName={user})","handlingStrategy":"validation","validationCode":"// pre-check with ldapsearch using CAS bind credentials\n// ldapsearch -H ldaps://dir -D binddn -w pw -b 'ou=people,dc=example,dc=org' '(uid=jdoe)'","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate base-dn/search-filter with ldapsearch before rollout","Ensure bind account read rights","Keep surrogate attribute provisioning automated"],"tags":["ldap","surrogate","empty-result","impersonation"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}