{"record":{"id":"a0f860a6481e802e","repo":"apereo/cas","slug":"password-cannot-be-blank","errorCode":null,"errorMessage":"Password cannot be blank","messagePattern":"Password cannot be blank","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authorization/EndpointLdapAuthenticationProvider.java","lineNumber":68,"sourceCode":"        return new UsernamePasswordAuthenticationToken(username, credentials, authorities);\n    }\n\n    /**\n     * Destroy.\n     */\n    @Override\n    public void destroy() {\n        authenticator.close();\n    }\n\n    @Override\n    public Authentication authenticate(final Authentication authentication) throws AuthenticationException {\n        try {\n            val username = Objects.requireNonNull(authentication.getPrincipal()).toString();\n            val credentials = authentication.getCredentials();\n            val password = Optional.ofNullable(credentials).map(Object::toString).orElse(null);\n            if (StringUtils.isBlank(password)) {\n                throw new IllegalArgumentException(\"Password cannot be blank\");\n            }\n            LOGGER.debug(\"Preparing LDAP authentication request for user [{}]\", username);\n            val request = new AuthenticationRequest(username, new Credential(password), ReturnAttributes.ALL.value());\n            LOGGER.debug(\"Executing LDAP authentication request for user [{}]\", username);\n\n            val response = authenticator.authenticate(request);\n            LOGGER.debug(\"LDAP response: [{}]\", response);\n\n            if (response.isSuccess()) {\n                val requiredRoles = securityProperties\n                    .getUser()\n                    .getRoles()\n                    .stream()\n                    .map(role -> Strings.CI.prependIfMissing(role, ldapProperties.getLdapAuthz().getRolePrefix()))\n                    .map(String::toUpperCase)\n                    .collect(Collectors.toList());\n\n                LOGGER.debug(\"Required roles are [{}]\", requiredRoles);","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/authorization/EndpointLdapAuthenticationProvider.java#L50-L86","documentation":"EndpointLdapAuthenticationProvider.authenticate() (the actuator-endpoint authentication provider) rejects any Authentication whose credentials are null or blank with IllegalArgumentException, because an LDAP bind with an empty password is meaningless and some directories treat empty-password binds as anonymous success.","triggerScenarios":"Calling authenticate(new UsernamePasswordAuthenticationToken(user, null)) or with \"\" as credentials — e.g. an endpoint client that posts a username but omits the password field.","commonSituations":"Management/console tooling sending incomplete credentials to the CAS actuator endpoint; scripts building the Authentication token programmatically and forgetting credentials; form field name mismatch so the password never reaches the token.","solutions":["Supply a non-blank password in the UsernamePasswordAuthenticationToken/credentials before calling authenticate","Fix the client payload so the password parameter is actually populated and named correctly","Validate input at your controller/proxy before invoking the provider"],"exampleFix":"// before\nnew UsernamePasswordAuthenticationToken(user, null);\n// after\nnew UsernamePasswordAuthenticationToken(user, password.trim());","handlingStrategy":"validation","validationCode":"if (password == null || password.isBlank()) {\n    throw new IllegalArgumentException(\"Password is required for endpoint authentication\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    provider.authenticate(token);\n} catch (IllegalArgumentException e) {\n    if (\"Password cannot be blank\".equals(e.getMessage())) {\n        // reject the request with 400: missing password\n    }\n}","preventionTips":["Validate username/password at the API layer before constructing the Authentication token","Ensure form/JSON field names map correctly to the password parameter","Never call authenticate() with null credentials — fail fast in your own controller"],"tags":["ldap","validation","empty-credentials"],"backgroundTag":"empty-required-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}