{"record":{"id":"7242824558f56160","repo":"shuzheng/zheng","slug":"unknownaccountexception","errorCode":null,"errorMessage":"UnknownAccountException","messagePattern":"UnknownAccountException","errorType":"exception","errorClass":"UnknownAccountException","httpStatus":null,"severity":"warning","filePath":"zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java","lineNumber":88,"sourceCode":"     * @param authenticationToken\n     * @return\n     * @throws AuthenticationException\n     */\n    @Override\n    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {\n        String username = (String) authenticationToken.getPrincipal();\n        String password = new String((char[]) authenticationToken.getCredentials());\n        // client无密认证\n        String upmsType = PropertiesFileUtil.getInstance(\"zheng-upms-client\").get(\"zheng.upms.type\");\n        if (\"client\".equals(upmsType)) {\n            return new SimpleAuthenticationInfo(username, password, getName());\n        }\n\n        // 查询用户信息\n        UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);\n\n        if (null == upmsUser) {\n            throw new UnknownAccountException();\n        }\n        if (!upmsUser.getPassword().equals(MD5Util.md5(password + upmsUser.getSalt()))) {\n            throw new IncorrectCredentialsException();\n        }\n        if (upmsUser.getLocked() == 1) {\n            throw new LockedAccountException();\n        }\n\n        return new SimpleAuthenticationInfo(username, password, getName());\n    }\n\n}\n","sourceCodeStart":70,"sourceCodeEnd":101,"githubUrl":"https://github.com/shuzheng/zheng/blob/7005c0a775e6d014d1dc8a8a809f7b1c13bf785a/zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java#L70-L101","documentation":"UpmsRealm (Apache Shiro realm) throws Shiro's UnknownAccountException during doGetAuthenticationInfo when no UpmsUser exists in the database for the submitted username. It signals the login attempt used an account that does not exist.","triggerScenarios":"Subject.login(new UsernamePasswordToken(username, password)) where upmsApiService.selectUpmsUserByUsername(username) returns null — i.e. the username is not present in the upms_user table.","commonSituations":"User typed the wrong username; test data was not seeded into the UPMS database; app connects to a different DB/environment than where the account was created; case-sensitivity or whitespace in the submitted username.","solutions":["Check the username for typos/case and retry with a registered account.","Verify the upms_user table contains a row with that username (SELECT * FROM upms_user WHERE username = ...).","Confirm the client connects to the intended database (correct datasource URL/env).","Handle UnknownAccountException in the login controller and show a generic 'invalid credentials' message to avoid user enumeration."],"exampleFix":"// before\nUser user = userService.login(username, password); // may throw UnknownAccountException\n// after\ntry {\n    currentUser.login(token);\n} catch (UnknownAccountException uae) {\n    model.addAttribute(\"error\", \"账号不存在\");\n    return \"login\";\n}","handlingStrategy":"try-catch","validationCode":"// pre-check without Shiro\nUpmsUser u = upmsApiService.selectUpmsUserByUsername(username);\nif (u == null) {\n    // show 'invalid username or password' before attempting login\n}","typeGuard":"boolean accountExists(String username) {\n    return upmsApiService.selectUpmsUserByUsername(username) != null;\n}","tryCatchPattern":"try {\n    currentUser.login(token);\n} catch (UnknownAccountException e) {\n    model.addAttribute(\"error\", \"账号或密码错误\"); // avoid revealing account existence\n    return \"login\";\n}","preventionTips":["Catch UnknownAccountException explicitly in every login controller.","Return a generic 'invalid credentials' message to prevent user enumeration.","Seed test accounts in each environment's upms_user table.","Normalize username input (trim, lowercase policy) before login.","Verify datasource points to the environment where accounts exist."],"tags":["authentication","shiro","login","unknown-account"],"backgroundTag":"unknown-account-exception","analyzedSha":"7005c0a775e6d014d1dc8a8a809f7b1c13bf785a","analyzedAt":"2026-09-04T16:58:32.852Z","contentChangedAt":"2026-09-04T16:58:32.852Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}