{"record":{"id":"55b12377f96d9015","repo":"apereo/cas","slug":"principal-resolution-is-unable-to-produce-a-result","errorCode":null,"errorMessage":"Principal resolution is unable to produce a result and will return null","messagePattern":"Principal resolution is unable to produce a result and will return null","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-person-directory-core/src/main/java/org/apereo/cas/authentication/principal/resolvers/PersonDirectoryPrincipalResolver.java","lineNumber":90,"sourceCode":"        }\n        LOGGER.trace(\"Creating principal for [{}]\", principalId);\n        if (context.isResolveAttributes()) {\n            val attributes = retrievePersonAttributes(principalId, credential,\n                currentPrincipal, new HashMap<>(), service, handler);\n            if (attributes == null || attributes.isEmpty()) {\n                LOGGER.debug(\"Principal id [{}] did not specify any attributes\", principalId);\n                if (!context.isReturnNullIfNoAttributes()) {\n                    val principal = buildResolvedPrincipal(principalId, new HashMap<>(), credential, currentPrincipal, handler);\n                    LOGGER.debug(\"Returning the principal with id [{}] without any attributes\", principal);\n                    return principal;\n                }\n                LOGGER.debug(\"[{}] is configured to return null if no attributes are found for [{}]\", getClass().getName(), principalId);\n                return null;\n            }\n            LOGGER.debug(\"Retrieved [{}] attribute(s) from the repository\", attributes.size());\n            val result = convertPersonAttributesToPrincipal(principalId, currentPrincipal, attributes);\n            if (!result.isSuccess() && context.isReturnNullIfNoAttributes()) {\n                LOGGER.warn(\"Principal resolution is unable to produce a result and will return null\");\n                return null;\n            }\n\n            val principal = buildResolvedPrincipal(result.getPrincipalId(), result.getAttributes(),\n                credential, currentPrincipal, handler);\n            LOGGER.debug(\"Final resolved principal by [{}] is [{}]\", getName(), principal);\n            return principal;\n        }\n        val principal = buildResolvedPrincipal(principalId, new HashMap<>(),\n            credential, currentPrincipal, handler);\n        LOGGER.debug(\"Final resolved principal by [{}] without resolving attributes is [{}]\", getName(), principal);\n        return principal;\n    }\n\n    @Override\n    public boolean supports(final Credential credential) {\n        return credential != null && credential.getId() != null;\n    }","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-person-directory-core/src/main/java/org/apereo/cas/authentication/principal/resolvers/PersonDirectoryPrincipalResolver.java#L72-L108","documentation":"PersonDirectoryPrincipalResolver.resolve could not build a valid principal from the retrieved attributes; because returnNullIfNoAttributes is enabled, it logs this warning and returns null instead of throwing, meaning the credential will not be associated with a resolved principal.","triggerScenarios":"convertPersonAttributesToPrincipal fails to produce a successful result (no usable principal id/attributes) and the resolver's returnNullIfNoAttributes flag is true during resolve().","commonSituations":"Attribute repository returns no attributes for the principal id; attribute mapping misconfigured so required attributes are missing; caching/screens configuration excludes attributes; principal id attribute resolves to blank.","solutions":["Set cas.authn.attribute-repository.return-null-if-no-attributes=false if a principal without attributes is acceptable","Verify the attribute repository (LDAP/JDBC/JSON) returns attributes for this user","Check the principal attribute mapping/attribute names in cas.authn.attribute-repository.* configuration","Enable debug logging to see the principalId and retrieved attribute count before conversion"],"exampleFix":"// before\ncas.authn.attribute-repository.return-null-if-no-attributes=true\n// after\ncas.authn.attribute-repository.return-null-if-no-attributes=false","handlingStrategy":"fallback","validationCode":"if (attributes.isEmpty()) { LOGGER.warn(\"No attributes for {}\", principalId); }","typeGuard":null,"tryCatchPattern":"Principal p = resolver.resolve(cred, Optional.of(ctx)); if (p == null) { use fallback principal or fail with clear message; }","preventionTips":["Verify the attribute repository returns data for all users","Set return-null-if-no-attributes deliberately, not by default","Monitor authentication records for null-principal events"],"tags":["principal-resolution","person-directory","attributes"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}