{"record":{"id":"5faa4098e3bd2d9a","repo":"apereo/cas","slug":"resolved-credentials-for-this-transaction-are-empt","errorCode":null,"errorMessage":"Resolved credentials for this transaction are empty","messagePattern":"Resolved credentials for this transaction are empty","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"critical","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java","lineNumber":216,"sourceCode":"\n    protected Collection<AuthenticationMetaDataPopulator> getAuthenticationMetadataPopulatorsForTransaction(\n        final AuthenticationTransaction transaction) {\n        return authenticationEventExecutionPlan.getAuthenticationMetadataPopulators(transaction);\n    }\n\n    protected void publishEvent(final ApplicationEvent event) {\n        if (applicationContext != null) {\n            applicationContext.publishEvent(event);\n        }\n    }\n\n    protected AuthenticationBuilder authenticateInternal(final AuthenticationTransaction transaction) throws Throwable {\n        val credentials = transaction.getCredentials();\n        LOGGER.debug(\"Authentication credentials provided for this transaction are [{}]\", credentials);\n\n        if (credentials.isEmpty()) {\n            LOGGER.error(\"Resolved authentication handlers for this transaction are empty\");\n            throw new AuthenticationException(\"Resolved credentials for this transaction are empty\");\n        }\n\n        val authenticationBuilder = new DefaultAuthenticationBuilder(NullPrincipal.getInstance());\n        credentials.forEach(authenticationBuilder::addCredential);\n\n        val handlerSet = authenticationEventExecutionPlan.resolveAuthenticationHandlers(transaction);\n        LOGGER.debug(\"Candidate resolved authentication handlers for this transaction are [{}]\", handlerSet);\n\n        try {\n            for (val credential : credentials) {\n                LOGGER.debug(\"Attempting to authenticate credential [{}]\", credential);\n\n                val itHandlers = handlerSet.iterator();\n                var proceedWithNextHandler = true;\n                while (proceedWithNextHandler && itHandlers.hasNext()) {\n                    val handler = itHandlers.next();\n                    if (handler.supports(credential)) {\n                        try {","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java#L198-L234","documentation":"DefaultAuthenticationManager.authenticateInternal throws AuthenticationException when the AuthenticationTransaction contains no credentials. This indicates the credential-extraction step upstream resolved to an empty set, so there is nothing to authenticate against the handler execution plan.","triggerScenarios":"Invoking the AuthenticationManager with an AuthenticationTransaction whose getCredentials() is empty — e.g. a login flow that posted no credential parameters (missing username/password fields), or a custom credential extractor that filtered out the credentials before the transaction was built.","commonSituations":"Webflow misconfiguration where the login form binds to different parameter names than the extractors expect; custom AuthenticationTransaction created manually with no credentials; API/REST authentication request missing body parameters; extractor beans disabled by feature conditions.","solutions":["Inspect the incoming request and ensure credential parameters (username/password or token) are actually submitted.","Verify the credential extractors (e.g. cas.authn.accept.credentials-extractor or the flow's form object) match the request parameter names.","If building the transaction programmatically, ensure you call TransactionBuilder.bind(...) with at least one credential.","Check for recently changed custom extractors/filters that drop credentials; restore them or return the original credential.","Enable DEBUG logging for org.apereo.cas.authentication to trace the resolved credentials list."],"exampleFix":"// before\nAuthenticationTransaction.with(service).collect(); // no credentials bound\n// after\nAuthenticationTransaction.with(service).bind(credential).collect();","handlingStrategy":"validation","validationCode":"// before invoking the authentication manager\nvar creds = transaction.getCredentials();\nif (creds == null || creds.isEmpty()) {\n    throw new InvalidRequestException(\"No credentials bound to the authentication transaction\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return authenticationManager.authenticate(transaction);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"credentials for this transaction are empty\")) {\n        LOGGER.error(\"Login request carried no credentials; check form/extractor parameter names\", e);\n    }\n    throw e;\n}","preventionTips":["Add webflow/form validation rejecting empty login submissions before authentication.","Keep credential extractor parameter names in sync with the login form fields.","Write an integration test asserting a credential-less request fails early and observably."],"tags":["authentication","credentials","empty-input"],"backgroundTag":"empty-required-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}