{"record":{"id":"acabbc804a20c7c2","repo":"apereo/cas","slug":"no-user-can-be-accepted-because-none-is-defined","errorCode":null,"errorMessage":"No user can be accepted because none is defined","messagePattern":"No user can be accepted because none is defined","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java","lineNumber":61,"sourceCode":"\n    public AcceptUsersAuthenticationHandler(final String name) {\n        this(name, PrincipalFactoryUtils.newPrincipalFactory(), Integer.MAX_VALUE, new HashMap<>());\n    }\n\n    public AcceptUsersAuthenticationHandler(final @Nullable String name,\n                                            final PrincipalFactory principalFactory, final Integer order,\n                                            final Map<String, String> users) {\n        super(name, principalFactory, order);\n        this.users = users;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential credential,\n        @Nullable final String originalPassword) throws Throwable {\n\n        if (this.users == null || this.users.isEmpty()) {\n            throw new FailedLoginException(\"No user can be accepted because none is defined\");\n        }\n        val username = credential.getUsername();\n        val cachedPassword = this.users.get(username);\n        if (cachedPassword == null) {\n            LOGGER.debug(\"[{}] was not found in the map.\", username);\n            throw new AccountNotFoundException(username + \" not found in backing map.\");\n        }\n        if (!Strings.CS.equals(credential.toPassword(), cachedPassword)) {\n            throw new FailedLoginException();\n        }\n        val strategy = getPasswordPolicyHandlingStrategy();\n        if (strategy != null && StringUtils.isNotBlank(username)) {\n            LOGGER.debug(\"Attempting to examine and handle password policy via [{}]\", strategy.getClass().getSimpleName());\n            val principal = this.principalFactory.createPrincipal(username);\n            val messageList = strategy.handle(principal, getPasswordPolicyConfiguration());\n            return createHandlerResult(credential, principal, messageList);\n        }\n        throw new FailedLoginException(\"Unable to authenticate \" + credential.getId());","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java#L43-L79","documentation":"AcceptUsersAuthenticationHandler (static in-memory username/password map) throws FailedLoginException when its users map is null or empty, since no credential could ever succeed. It indicates the handler is registered but was never populated with accepted users.","triggerScenarios":"cas.authn.accept.users is blank/unset (or the bean is built with an empty map) and a UsernamePasswordCredential is submitted to this handler.","commonSituations":"Deployments where cas.authn.accept.users was never set or lost during property migration; test/static deployments promoted without configuration.","solutions":["Set cas.authn.accept.users, e.g. casuser::Mellon (or populate the users map in the bean)","Remove the AcceptUsersAuthenticationHandler if in-memory acceptance is not intended","Switch to a real credential source (LDAP/JDBC/etc.) instead of the static handler"],"exampleFix":"// before\ncas.authn.accept.users=\n// after\ncas.authn.accept.users=casuser::Mellon","handlingStrategy":"validation","validationCode":"// before startup\nif (casProperties.getAuthn().getAccept().getUsers() == null || casProperties.getAuthn().getAccept().getUsers().isEmpty()) {\n    throw new IllegalStateException(\"cas.authn.accept.users must be defined when the accept-users handler is enabled\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    handlerResult = acceptUsersHandler.authenticate(credential, service);\n} catch (FailedLoginException e) {\n    if (\"No user can be accepted because none is defined\".equals(e.getMessage())) {\n        LOGGER.error(\"Populate cas.authn.accept.users or disable the accept-users handler\");\n    }\n}","preventionTips":["Always set cas.authn.accept.users when relying on the static handler","Validate authentication configuration at startup","Prefer a real credential source over the in-memory handler for production"],"tags":["java","authentication","configuration"],"backgroundTag":"missing-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}