{"record":{"id":"a75e12f2b3ff681c","repo":"apereo/cas","slug":"email-address-for-is-not-valid","errorCode":null,"errorMessage":"Email address [{}] for [{}] is not valid","messagePattern":"Email address \\[(.+?)\\] for \\[(.+?)\\] is not valid","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pm-ldap/src/main/java/org/apereo/cas/pm/LdapPasswordManagementService.java","lineNumber":58,"sourceCode":"        super(casProperties, cipherExecutor, passwordHistoryService);\n        this.connectionFactoryMap = Map.copyOf(connectionFactoryMap);\n    }\n\n    @Override\n    public void destroy() {\n        this.connectionFactoryMap.forEach((ldap, connectionFactory) ->\n            connectionFactory.close());\n    }\n\n    @Override\n    public Set<String> findEmails(final PasswordManagementQuery query) {\n        val email = findAttribute(query, casProperties.getAuthn().getPm().getReset().getMail().getAttributeName(),\n            CollectionUtils.wrap(query.getUsername()));\n        if (EmailValidator.getInstance().isValid(email)) {\n            LOGGER.debug(\"Email address [{}] for [{}] appears valid\", email, query.getUsername());\n            return Set.of(email);\n        }\n        LOGGER.warn(\"Email address [{}] for [{}] is not valid\", email, query.getUsername());\n        return Set.of();\n    }\n\n    @Override\n    public String findPhone(final PasswordManagementQuery query) {\n        return findAttribute(query, casProperties.getAuthn().getPm().getReset().getSms().getAttributeName(), CollectionUtils.wrap(query.getUsername()));\n    }\n\n    @Override\n    public String findUsername(final PasswordManagementQuery query) {\n        return findAttribute(query, casProperties.getAuthn().getPm().getLdap().stream()\n            .map(LdapPasswordManagementProperties::getUsernameAttribute)\n            .collect(Collectors.toList()), CollectionUtils.wrap(query.getEmail()));\n    }\n\n    @Override\n    public void updateSecurityQuestions(final PasswordManagementQuery query) {\n        findEntries(CollectionUtils.wrap(query.getUsername()), true)","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pm-ldap/src/main/java/org/apereo/cas/pm/LdapPasswordManagementService.java#L40-L76","documentation":"LdapPasswordManagementService.findEmails reads the configured mail attribute for the user from LDAP and validates it with commons-validator's EmailValidator. If the stored value fails validation the warn is logged and an empty set is returned, which downstream causes the reset flow to report 'no recipient'.","triggerScenarios":"findAttribute returned a value for cas.authn.pm.reset.mail.attributeName, but EmailValidator.getInstance().isValid(email) is false — e.g. malformed address, multiple/blank values, or a placeholder string.","commonSituations":"LDAP mail attribute contains a list or concatenated values; entry has 'user@example' or empty string; attribute mapped to the wrong LDAP field (e.g. uid); trailing spaces or non-ASCII data in the attribute.","solutions":["Inspect the user's LDAP entry value for the mail attribute and correct it to a valid single RFC-822 address","Point cas.authn.pm.reset.mail.attributeName at the attribute that actually holds a valid email","Use a multivalued-aware mapping/objectClass so only a proper mail attribute is returned","If the address format is legitimately unusual, normalize it in the directory or use a custom PasswordManagementService"],"exampleFix":"// before\ncas.authn.pm.reset.mail.attributeName=mail\n// directory value: 'jsmith@example' (invalid)\n// after — fix LDAP entry or map the right attribute\ncas.authn.pm.reset.mail.attributeName=mail\n// directory value: 'jsmith@example.com' (valid)","handlingStrategy":"validation","validationCode":"String email = ldapMailAttribute;\nif (email == null || !org.apache.commons.validator.routines.EmailValidator.getInstance().isValid(email)) {\n    log.warn(\"Refusing reset: invalid email {}\", email);\n}","typeGuard":"boolean isValidEmail(String v) {\n    return v != null && org.apache.commons.validator.routines.EmailValidator.getInstance().isValid(v.trim());\n}","tryCatchPattern":null,"preventionTips":["Directory data hygiene: audit mail attributes for malformed/multivalued values","Map the PM mail attribute to a field guaranteed to hold one RFC-822 address","Add a periodic report of entries whose mail attribute fails validation"],"tags":["email-validation","ldap","password-management"],"backgroundTag":"invalid-argument-format","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}