{"record":{"id":"a2d3f351202d17fa","repo":"apereo/cas","slug":"no-surrogate-identifier-was-selected-or-provided","errorCode":null,"errorMessage":"No surrogate identifier was selected or provided","messagePattern":"No surrogate identifier was selected or provided","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-surrogate-webflow/src/main/java/org/apereo/cas/web/flow/action/SurrogateSelectionAction.java","lineNumber":59,"sourceCode":"    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {\n        val resultMap = new HashMap<String, Object>();\n        try {\n            val credential = WebUtils.getCredential(requestContext);\n            if (credential instanceof final MutableCredential mc) {\n                val surrogateTarget = WebUtils.getRequestParameterOrAttribute(requestContext, PARAMETER_NAME_SURROGATE_TARGET)\n                    .orElse(StringUtils.EMPTY);\n                LOGGER.debug(\"Located surrogate target as [{}]\", surrogateTarget);\n\n                if (StringUtils.isNotBlank(surrogateTarget)) {\n                    resultMap.put(PARAMETER_NAME_SURROGATE_TARGET, surrogateTarget);\n                    val registeredService = WebUtils.getRegisteredService(requestContext);\n                    val builder = WebUtils.getAuthenticationResultBuilder(requestContext);\n                    mc.getCredentialMetadata().addTrait(new SurrogateCredentialTrait(surrogateTarget));\n                    val result = surrogatePrincipalBuilder.buildSurrogateAuthenticationResult(builder, mc, registeredService);\n                    result.ifPresent(bldr -> WebUtils.putAuthenticationResultBuilder(bldr, requestContext));\n                } else {\n                    LOGGER.warn(\"No surrogate identifier was selected or provided\");\n                }\n                resultMap.put(\"primary\", credential.getId());\n            } else {\n                LOGGER.debug(\"Credential is not supported [{}]\", credential);\n            }\n            return success(resultMap);\n        } catch (final Throwable e) {\n            WebUtils.addErrorMessageToContext(requestContext, \"screen.surrogates.account.selection.error\",\n                \"Unable to accept or authorize selection\");\n            LoggingUtils.error(LOGGER, e);\n            return error(new RuntimeException(e));\n        }\n    }\n}\n","sourceCodeStart":41,"sourceCodeEnd":74,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-surrogate-webflow/src/main/java/org/apereo/cas/web/flow/action/SurrogateSelectionAction.java#L41-L74","documentation":"SurrogateSelectionAction finalizes the webflow surrogate-selection step. If the credential is a supported (username/password) credential but no surrogate target identifier was supplied (form field, request parameter, or previously selected value), it logs this warning and continues with just the primary identity - the user proceeds as themselves without impersonation. It signals the selection step was skipped or the UI failed to submit a choice.","triggerScenarios":"doExecuteInternal finds a supported credential, but the surrogate target request parameter / selected identifier is blank after evaluation, so the branch that adds SurrogateCredentialTrait and builds the surrogate authentication result never runs.","commonSituations":"Theme/page does not render or submit the surrogate selection input; user leaves the selector empty expecting self-login; custom webflow modifications dropped the surrogateSelection parameter; direct POST to login bypassing the selection page.","solutions":["Ensure the login form for surrogate-enabled services includes and submits the surrogate selection field.","Verify the custom theme/webflow passes the surrogate identifier parameter through to the action.","If self-login is intended, ignore the warning or disable surrogate for that service to stop the selection prompt.","Test the selection page flow end-to-end after any webflow customization."],"exampleFix":"<!-- before: form missing surrogate input -->\n<input type=\"text\" name=\"username\"/>\n<!-- after -->\n<input type=\"text\" name=\"username\"/>\n<input type=\"text\" name=\"surrogateTarget\" placeholder=\"impersonate user\"/>","handlingStrategy":"validation","validationCode":"String surrogateTarget = requestContext.getRequestParameters().get(\"surrogateTarget\");\nif (surrogateTarget == null || surrogateTarget.isBlank()) {\n    // render selection page or proceed as primary user deliberately\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always render/submit the surrogate selector when surrogate is enabled","Regression-test login page after theme changes","Don't POST directly to login bypassing the selection step"],"tags":["surrogate","webflow","selection","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}