{"record":{"id":"9fbace52c4f27e93","repo":"apereo/cas","slug":"multiple-records-found-for-username-9fbace","errorCode":null,"errorMessage":"Multiple records found for [username]","messagePattern":"Multiple records found for \\[username\\]","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-jdbc-authentication/src/main/java/org/apereo/cas/jdbc/QueryDatabaseAuthenticationHandler.java","lineNumber":104,"sourceCode":"                    throw new AccountDisabledException(\"Account has been disabled\");\n                }\n            }\n            if (StringUtils.isNotBlank(properties.getFieldExpired()) && dbFields.containsKey(properties.getFieldExpired())) {\n                val dbExpired = dbFields.get(properties.getFieldExpired()).toString();\n                if (BooleanUtils.toBoolean(dbExpired) || \"1\".equals(dbExpired)) {\n                    throw new AccountPasswordMustChangeException(\"Password has expired\");\n                }\n            }\n\n            val attributes = collectPrincipalAttributes(dbFields);\n            val principal = this.principalFactory.createPrincipal(username, attributes);\n            return createHandlerResult(credential, principal, new ArrayList<>());\n\n        } catch (final IncorrectResultSizeDataAccessException e) {\n            if (e.getActualSize() == 0) {\n                throw new AccountNotFoundException(username + \" not found with SQL query\");\n            }\n            throw new FailedLoginException(\"Multiple records found for \" + username);\n        } catch (final DataAccessException e) {\n            throw new PreventedException(e);\n        }\n    }\n\n    protected Map<String, Object> query(final UsernamePasswordCredential credential) {\n        val sql = SpringExpressionLanguageValueResolver.getInstance().resolve(properties.getSql());\n        if (sql.contains(\"?\")) {\n            return getJdbcTemplate().queryForMap(sql, credential.getUsername());\n        }\n        val parameters = new LinkedHashMap<String, Object>();\n        parameters.put(\"username\", credential.getUsername());\n        parameters.put(\"password\", credential.toPassword());\n        return getNamedParameterJdbcTemplate().queryForMap(sql, parameters);\n    }\n}\n","sourceCodeStart":86,"sourceCodeEnd":121,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-jdbc-authentication/src/main/java/org/apereo/cas/jdbc/QueryDatabaseAuthenticationHandler.java#L86-L121","documentation":"When IncorrectResultSizeDataAccessException reports more than one row (actualSize > 1), the handler throws FailedLoginException 'Multiple records found'. The query is expected to return exactly one row per username; duplicates make identity ambiguous so login is refused.","triggerScenarios":"sqlFindByUsername matches 2+ rows for the submitted username because the username column is not unique in the table.","commonSituations":"Missing UNIQUE constraint on the username column after data import; soft-deleted duplicate rows; username colliding across tenants in a shared table.","solutions":["Deduplicate rows: SELECT username, COUNT(*) FROM users GROUP BY username HAVING COUNT(*)>1, then remove/disable extras.","Add a UNIQUE index on the username column to prevent recurrence.","Refine the SQL to disambiguate (extra WHERE condition, status=active filter).","Fix upstream provisioning that created the duplicate account."],"exampleFix":"// before: no constraint, duplicates possible\n// after\nDELETE FROM users WHERE id NOT IN (SELECT MIN(id) FROM users GROUP BY username);\nALTER TABLE users ADD CONSTRAINT uq_users_username UNIQUE (username);","handlingStrategy":"validation","validationCode":"List<String> dupes = jdbcTemplate.queryForList(\n  \"SELECT username FROM users GROUP BY username HAVING COUNT(*)>1\", String.class);\nif (!dupes.isEmpty()) { throw new IllegalStateException(\"Duplicate usernames: \" + dupes); }","typeGuard":null,"tryCatchPattern":"try { result = handler.authenticate(credential); }\ncatch (FailedLoginException e) { if (e.getMessage().startsWith(\"Multiple records\")) { alertDataIntegrity(); } }","preventionTips":["Enforce a UNIQUE constraint on the username column.","Filter soft-deleted/legacy rows out of the auth query.","Run periodic duplicate-detection queries as a data-integrity check."],"tags":["jdbc","sql","duplicate-records"],"backgroundTag":"database-query-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}