{"record":{"id":"4999d8f12367c685","repo":"apereo/cas","slug":"is-configured-to-use-but-it-does-not-sup","errorCode":null,"errorMessage":"[{}] is configured to use [{}] but it does not support [{}], which suggests a configuration problem.","messagePattern":"\\[(.+?)\\] is configured to use \\[(.+?)\\] but it does not support \\[(.+?)\\], which suggests a configuration problem\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java","lineNumber":123,"sourceCode":"        authentication.getSuccesses().values()\n            .forEach(result -> builder.addAttribute(AUTHENTICATION_METHOD_ATTRIBUTE, result.getHandlerName()));\n    }\n\n    protected @Nullable Principal resolvePrincipal(final AuthenticationHandler handler, final PrincipalResolver resolver,\n                                                   final Credential credential, final Principal principal,\n                                                   final Service service) {\n        if (resolver.supports(credential)) {\n            try {\n                val resolved = resolver.resolve(credential, Optional.ofNullable(principal),\n                    Optional.ofNullable(handler), Optional.ofNullable(service));\n                LOGGER.debug(\"[{}] resolved [{}] from [{}]\", resolver, resolved, credential);\n                return resolved;\n            } catch (final Throwable e) {\n                LOGGER.error(\"[{}] failed to resolve principal from [{}]\", resolver, credential);\n                LoggingUtils.error(LOGGER, e);\n            }\n        } else {\n            LOGGER.warn(\"[{}] is configured to use [{}] but it does not support [{}], which suggests a configuration problem.\",\n                handler.getName(), resolver, credential);\n        }\n        return null;\n    }\n\n    protected boolean invokeAuthenticationPreProcessors(final AuthenticationTransaction transaction) throws Throwable {\n        LOGGER.trace(\"Invoking authentication pre processors for authentication transaction\");\n        val pops = authenticationEventExecutionPlan.getAuthenticationPreProcessors(transaction);\n\n        val supported = pops.stream()\n            .filter(processor -> transaction.getCredentials()\n                .stream()\n                .anyMatch(Unchecked.predicate(processor::supports)))\n            .toList();\n\n        var processed = true;\n        val it = supported.iterator();\n        while (processed && it.hasNext()) {","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java#L105-L141","documentation":"In DefaultAuthenticationManager.resolvePrincipal, CAS skipped the configured PrincipalResolver because the resolver does not support the credential produced by the authentication handler. This is a warning indicating a wiring/misconfiguration: the handler and resolver credential types do not line up, so no principal resolution occurs and resolvePrincipal returns null.","triggerScenarios":"A PrincipalHandlerResolver/PrincipalResolver was registered whose supports(credential) returns false for the credential emitted by the authentication handler; resolvePrincipal is reached during authenticateAndResolvePrincipal after a handler successfully authenticates.","commonSituations":"Configuring a resolver for credential type A (e.g. UsernamePasswordCredential) while the matched handler returns a different credential type; custom resolvers registered in the wrong module or overridden by @ConditionalOnMissingBean defaults; service-specific handler/resolver mappings where the resolver was defined for another authentication policy.","solutions":["Check the handler's returned credential type and ensure the configured PrincipalResolver.supports() includes that type.","Remove or correct the mis-mapped resolver in the CAS configuration (cas.authn.*.principalResolver / principalTransformation settings).","Register a resolver bean that explicitly declares support for the credential class, or rely on the default PersonDirectoryPrincipalResolver wiring.","Enable debug logging for org.apereo.cas.authentication to see which handler/resolver pair is evaluated."],"exampleFix":"// before\n@Bean\npublic PrincipalResolver jdbcResolver(...) { /* supports only JwtCredential */ }\n// after\n@Bean\npublic PrincipalResolver personDirectoryPrincipalResolver() {\n    return new PersonDirectoryPrincipalResolver(principalFactory, attributeRepository);\n}","handlingStrategy":"validation","validationCode":"if (!principalResolver.supports(credential)) {\n    throw new IllegalStateException(\"Resolver \" + principalResolver.getName()\n        + \" does not support credential \" + credential.getClass().getSimpleName());\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Assert resolver.supports(credential) in unit tests for every handler/resolver pair.","Keep handler and resolver registrations in the same configuration class so their credential types stay in sync."],"tags":["authentication","principal-resolution","spring-config"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}