{"record":{"id":"690af8e36a572e43","repo":"apereo/cas","slug":"unable-to-locate-user-account","errorCode":null,"errorMessage":"Unable to locate user account","messagePattern":"Unable to locate user account","errorType":"exception","errorClass":"AccountNotFoundException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-mongo/src/main/java/org/apereo/cas/authentication/MongoDbAuthenticationHandler.java","lineNumber":62,"sourceCode":"                if (!result.containsKey(properties.getPasswordAttribute())) {\n                    throw new FailedLoginException(\"No password attribute found for \" + transformedCredential.getId());\n                }\n\n                val entryPassword = result.get(properties.getPasswordAttribute());\n                if (!getPasswordEncoder().matches(originalPassword, entryPassword.toString())) {\n                    LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", transformedCredential.getId());\n                    throw new FailedLoginException();\n                }\n                val attributes = result\n                    .entrySet()\n                    .stream()\n                    .filter(entry -> !entry.getKey().equals(properties.getPasswordAttribute()) && !entry.getKey().equals(properties.getUsernameAttribute()))\n                    .collect(Collectors.toMap(Map.Entry::getKey,\n                        entry -> CollectionUtils.toCollection(entry.getValue(), ArrayList.class), (__, b) -> b, () -> new HashMap<String, List<Object>>()));\n                val principal = this.principalFactory.createPrincipal(transformedCredential.getId(), attributes);\n                return createHandlerResult(transformedCredential, principal, new ArrayList<>());\n            }\n            throw new AccountNotFoundException(\"Unable to locate user account\");\n        }\n    }\n}\n","sourceCodeStart":44,"sourceCodeEnd":66,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-mongo/src/main/java/org/apereo/cas/authentication/MongoDbAuthenticationHandler.java#L44-L66","documentation":"MongoDbAuthenticationHandler throws AccountNotFoundException when the Mongo collection query (username-attribute equals the transformed username) returns no documents. This distinguishes 'unknown user' from 'wrong password' so CAS policies such as account throttling or lockout can react accordingly.","triggerScenarios":"authenticateUsernamePasswordInternal: collection.find(Filters.eq(usernameAttribute, username)) has no next() result — the username does not exist in the configured collection, or the query matches nothing due to attribute/collection misconfiguration.","commonSituations":"User not yet provisioned into the Mongo users collection; case sensitivity (Mongo queries are case-sensitive) causing 'Alice' vs 'alice' miss; wrong collection or database configured; username-attribute mismatch (e.g. docs use 'email' but config says 'username'); credential transformation (e.g. lowercasing) changing the id.","solutions":["Verify the user document exists: db.<collection>.findOne({<usernameAttribute>: '<entered username>'})","Check cas.authn.mongo[0].collection, database, and username-attribute point at the right collection and field","Watch for case/format differences; align cas.authn.mongo[0].credential-criteria/transformation with how usernames are stored","Provision the user account if it genuinely does not exist"],"exampleFix":"// config before\ncas.authn.mongo[0].username-attribute=username\n\n// after  (when docs store logins in the email field)\ncas.authn.mongo[0].username-attribute=email","handlingStrategy":"try-catch","validationCode":"// probe user existence before auth flow in admin tooling\nboolean exists = mongoTemplate.getCollection(collection)\n    .find(Filters.eq(usernameAttr, username)).iterator().hasNext();","typeGuard":null,"tryCatchPattern":"try {\n    return handler.authenticate(transaction);\n} catch (AccountNotFoundException e) {\n    logger.info(\"Unknown user attempted login: {}\", transaction.getCredential().getId());\n    throw new UnknownUsernameAuthenticationException();\n} catch (FailedLoginException e) {\n    throw new BadCredentialsAuthenticationException();\n}","preventionTips":["Confirm username-attribute, collection, and database match the actual Mongo data","Remember Mongo string matching is case-sensitive; normalize usernames on write and via credential transformation","Provision users before enabling Mongo authentication in production"],"tags":["mongodb","authentication","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}