{"record":{"id":"89fb2326eb56ce2e","repo":"apereo/cas","slug":"no-password-attribute-found-for","errorCode":null,"errorMessage":"No password attribute found for ","messagePattern":"No password attribute found for ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-mongo/src/main/java/org/apereo/cas/authentication/MongoDbAuthenticationHandler.java","lineNumber":45,"sourceCode":"    public MongoDbAuthenticationHandler(final String name,\n                                        final PrincipalFactory principalFactory,\n                                        final MongoDbAuthenticationProperties properties,\n                                        final MongoOperations mongoTemplate) {\n        super(name, principalFactory, properties.getOrder());\n        this.mongoTemplate = mongoTemplate;\n        this.properties = properties;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential transformedCredential,\n        @Nullable final String originalPassword) throws Throwable {\n        val collection = mongoTemplate.getCollection(properties.getCollection());\n        try (val it = collection.find(Filters.eq(properties.getUsernameAttribute(), transformedCredential.getUsername())).iterator()) {\n            if (it.hasNext()) {\n                val result = it.next();\n                if (!result.containsKey(properties.getPasswordAttribute())) {\n                    throw new FailedLoginException(\"No password attribute found for \" + transformedCredential.getId());\n                }\n\n                val entryPassword = result.get(properties.getPasswordAttribute());\n                if (!getPasswordEncoder().matches(originalPassword, entryPassword.toString())) {\n                    LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", transformedCredential.getId());\n                    throw new FailedLoginException();\n                }\n                val attributes = result\n                    .entrySet()\n                    .stream()\n                    .filter(entry -> !entry.getKey().equals(properties.getPasswordAttribute()) && !entry.getKey().equals(properties.getUsernameAttribute()))\n                    .collect(Collectors.toMap(Map.Entry::getKey,\n                        entry -> CollectionUtils.toCollection(entry.getValue(), ArrayList.class), (__, b) -> b, () -> new HashMap<String, List<Object>>()));\n                val principal = this.principalFactory.createPrincipal(transformedCredential.getId(), attributes);\n                return createHandlerResult(transformedCredential, principal, new ArrayList<>());\n            }\n            throw new AccountNotFoundException(\"Unable to locate user account\");\n        }","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-mongo/src/main/java/org/apereo/cas/authentication/MongoDbAuthenticationHandler.java#L27-L63","documentation":"MongoDbAuthenticationHandler authenticates username/password credentials by looking up the user document in the configured Mongo collection. If the document exists but lacks the configured password attribute field, the handler cannot compare passwords and throws FailedLoginException (authentication fails).","triggerScenarios":"cas.authn.mongo[0].password-attribute (default 'password') does not match any field in the user document returned by the query on username-attribute; authenticateUsernamePasswordInternal finds the document via collection.find(Filters.eq(usernameAttribute, username)) but result.containsKey(passwordAttribute) is false.","commonSituations":"Mongo documents storing the password under a different field name (e.g. 'pass', 'userPassword', 'pwd'); password field accidentally dropped during user provisioning scripts; wrong collection configured so a different schema's document matches; case mismatch between config and field name.","solutions":["Align cas.authn.mongo[0].password-attribute with the actual field name in your Mongo user documents","Inspect the user document (db.<collection>.findOne({username: '...'})) and confirm the password field exists and its exact spelling/case","Fix provisioning/import scripts so every user document includes the password field","Confirm the query targets the intended collection (cas.authn.mongo[0].collection)"],"exampleFix":"// document before\n{ \"username\": \"alice\", \"pwd\": \"$2a$10$...\" }\n\n// after  (or set password-attribute=pwd)\n{ \"username\": \"alice\", \"password\": \"$2a$10$...\" }","handlingStrategy":"validation","validationCode":"// verify the user doc has the password field before expecting login to work\nDocument user = mongoTemplate.getCollection(collection)\n    .find(Filters.eq(usernameAttr, username)).first();\nif (user == null || !user.containsKey(passwordAttr)) {\n    throw new IllegalStateException(\"User doc missing password attribute [\" + passwordAttr + \"]\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return authenticationHandler.authenticate(credential);\n} catch (FailedLoginException e) {\n    logger.warn(\"Login rejected for [{}]: {}\", credential.getId(), e.getMessage());\n    throw e;\n}","preventionTips":["Keep provisioning scripts writing the exact field name configured as password-attribute","Add a schema check/validator for user documents in the Mongo collection","Document the expected user document shape alongside CAS config"],"tags":["mongodb","authentication","schema"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}