{"record":{"id":"7991c89d6899f7c8","repo":"apereo/cas","slug":"dn-resolution-failed","errorCode":null,"errorMessage":"DN resolution failed. [{}]","messagePattern":"DN resolution failed\\. \\[(.+?)\\]","errorType":"exception","errorClass":"AccountNotFoundException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java","lineNumber":135,"sourceCode":"    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential upc,\n                                                                                        @Nullable final String originalPassword) throws Throwable {\n        val response = getLdapAuthenticationResponse(upc);\n        LOGGER.debug(\"LDAP response: [{}]\", response);\n        if (!passwordPolicyHandlingStrategy.supports(response)) {\n            LOGGER.warn(\"Authentication has failed because LDAP password policy handling strategy [{}] cannot handle [{}].\",\n                response, passwordPolicyHandlingStrategy.getClass().getSimpleName());\n            throw new FailedLoginException(\"Invalid credentials\");\n        }\n        LOGGER.debug(\"Attempting to examine and handle LDAP password policy via [{}]\",\n            passwordPolicyHandlingStrategy.getClass().getSimpleName());\n        val messageList = passwordPolicyHandlingStrategy.handle(response, getPasswordPolicyConfiguration());\n        if (response.isSuccess()) {\n            LOGGER.debug(\"LDAP response returned a result [{}], creating the final LDAP principal\", response.getLdapEntry());\n            val principal = createPrincipal(upc.getUsername(), response.getLdapEntry());\n            return createHandlerResult(upc, principal, messageList);\n        }\n        if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {\n            LOGGER.warn(\"DN resolution failed. [{}]\", response.getDiagnosticMessage());\n            throw new AccountNotFoundException(upc.getUsername() + \" not found.\");\n        }\n        throw new FailedLoginException(\"Invalid credentials\");\n    }\n\n    /**\n     * Creates a CAS principal with attributes if the LDAP entry contains principal attributes.\n     *\n     * @param username  Username that was successfully authenticated which is used for principal ID when principal id is not specified.\n     * @param ldapEntry LDAP entry that may contain principal attributes.\n     * @return Principal if the LDAP entry contains at least a principal ID attribute value.\n     * @throws LoginException On security policy errors related to principal creation.\n     */\n    protected @Nullable Principal createPrincipal(final String username, final LdapEntry ldapEntry) throws Throwable {\n        LOGGER.debug(\"Creating LDAP principal for [{}] based on [{}] and attributes [{}]\", username, ldapEntry.getDn(),\n            ldapEntry.getAttributeNames());\n        val id = getLdapPrincipalIdentifier(username, ldapEntry);\n        LOGGER.debug(\"LDAP principal identifier created is [{}]\", id);","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authentication/LdapAuthenticationHandler.java#L117-L153","documentation":"CAS's LDAP authentication handler throws AccountNotFoundException when the LDAP authentication result code is DN_RESOLUTION_FAILURE, meaning the directory could not resolve the supplied username to an entry DN. Unlike a wrong password, this means no matching user entry exists under the configured base DNs/search filters. The message logs the server's diagnostic message for details.","triggerScenarios":"authenticateUsernamePasswordInternal receives a response whose isSuccess() is false and whose getAuthenticationResultCode() equals AuthenticationResultCode.DN_RESOLUTION_FAILURE — i.e. the user search/filter matched no entry, so no DN could be resolved for bind.","commonSituations":"Typo'd or wrong username; users located outside the configured baseDn; userSearchFilter too restrictive (e.g. extra objectClass conditions the accounts lack); case or attribute mismatch (searching uid vs sAMAccountName); user disabled/removed but credentials cached client-side.","solutions":["Verify the username exists in the directory under the configured baseDn","Review cas.authn.ldap[0].userFilter / searchFilter and test it directly with ldapsearch for the failing user","Correct baseDn so the search scope actually contains user accounts","Check the logged diagnostic message [{}] for the exact filter/DN used","If users legitimately should not authenticate, handle AccountNotFoundException in the caller rather than changing config"],"exampleFix":"// before\ncas.authn.ldap[0].userFilter=uid={user},ou=people,dc=example,dc=org\n// users actually live under a different OU\n// after\ncas.authn.ldap[0].baseDn=ou=accounts,dc=example,dc=org\ncas.authn.ldap[0].userFilter=(uid={user})","handlingStrategy":"try-catch","validationCode":"// Validate the user exists before authenticating, using the same filter\nString filter = \"(uid=\" + LdapUtils.encodeLdapFilterValue(username) + \")\";\nboolean exists = !connection.search(baseDn, SearchScope.SUBTREE, filter).getEntries().isEmpty();","typeGuard":"if (AuthenticationResultCode.DN_RESOLUTION_FAILURE == response.getAuthenticationResultCode()) {\n    throw new AccountNotFoundException(username);\n}","tryCatchPattern":"try {\n    return ldapHandler.authenticate(credential);\n} catch (AccountNotFoundException e) {\n    return AuthenticationResult.UNKNOWN_USER;\n} catch (FailedLoginException e) {\n    return AuthenticationResult.FAILED;\n}","preventionTips":["Keep baseDn and userFilter aligned with the real directory tree; verify with ldapsearch","Escape/sanitize usernames to avoid filter injection and mismatched matching rules","Confirm attribute casing (uid vs sAMAccountName) matches your directory schema","Test a known-good username end-to-end after LDAP config changes","Return distinct results for unknown-user vs wrong-password in monitoring to spot config drift"],"tags":["ldap","authentication","user-not-found","dn-resolution"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}