{"record":{"id":"ad31871926ab921a","repo":"apereo/cas","slug":"no-identifier-found-for-this-user-profile","errorCode":null,"errorMessage":"No identifier found for this user profile: ","messagePattern":"No identifier found for this user profile: ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java","lineNumber":61,"sourceCode":"    protected BaseDelegatedClientAuthenticationHandler(final String name,\n                                                       final PrincipalFactory principalFactory, final Integer order,\n                                                       final SessionStore sessionStore) {\n        super(name, principalFactory, order);\n        this.sessionStore = sessionStore;\n    }\n\n    protected AuthenticationHandlerExecutionResult createResult(final ClientCredential credentials,\n                                                                final UserProfile profile,\n                                                                final BaseClient client,\n                                                                final Service service) throws Throwable {\n        if (profile == null) {\n            throw new FailedLoginException(\"Authentication did not produce a user profile for: \" + credentials);\n        }\n\n        val extractedCredential = new BasicIdentifiableCredential(determinePrincipalIdFrom(profile, client));\n        val id = transformUsername(extractedCredential);\n        if (StringUtils.isBlank(id)) {\n            throw new FailedLoginException(\"No identifier found for this user profile: \" + profile);\n        }\n        credentials.setUserProfile(profile);\n        credentials.setTypedIdUsed(isTypedIdUsed);\n        val attributes = CollectionUtils.toMultiValuedMap(profile.getAttributes());\n        attributes.put(Pac4jConstants.CLIENT_NAME, CollectionUtils.wrap(profile.getClientName()));\n        if (profile instanceof final BasicUserProfile bup) {\n            attributes.putAll(CollectionUtils.toMultiValuedMap(bup.getAuthenticationAttributes()));\n        }\n        val initialPrincipal = Objects.requireNonNull(principalFactory.createPrincipal(id, attributes));\n        val principal = finalizeAuthenticationPrincipal(initialPrincipal, client, credentials, service);\n        LOGGER.debug(\"Constructed authenticated principal [{}] based on user profile [{}]\", principal, profile);\n        return finalizeAuthenticationHandlerResult(credentials, principal, profile, client, service);\n    }\n\n    protected Principal finalizeAuthenticationPrincipal(final Principal initialPrincipal, final BaseClient client,\n                                                        final ClientCredential credentials, final Service service) throws Throwable {\n        return initialPrincipal;\n    }","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java#L43-L79","documentation":"After obtaining a non-null UserProfile, createResult derives the principal id via determinePrincipalIdFrom, applies username transformation, and throws FailedLoginException when the resulting identifier is blank. A profile without a usable id cannot produce a CAS principal.","triggerScenarios":"Delegated authentication profile exists but determinePrincipalIdFrom returns null/empty and transformUsername yields blank — e.g. profile has no typed id, no id attribute, or a username transformation (regex/PrincipalTransformer) strips the entire identifier.","commonSituations":"Overly aggressive username transformation patterns removing the whole ID; IdP returning profiles with empty subject; attribute-based principal-id resolution configured to a missing attribute.","solutions":["Inspect the UserProfile returned by the IdP (enable pac4j debug logs) to see why the id is empty","Review the configured username transformation/attribute for the delegated client and fix or remove it","Ensure the IdP reliably returns a subject/id for authenticated users"],"exampleFix":"// before\ncas.authn.pac4j.core.username-attribute=nonexistentAttr // principal id resolves blank\n// after\ncas.authn.pac4j.core.username-attribute=email // attribute the IdP actually returns","handlingStrategy":"validation","validationCode":"String id = profile != null ? profile.getId() : null;\nif (id == null || id.isBlank()) { failFast(\"delegated profile has no identifier\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit username transformation rules so they cannot blank out the id","Require the IdP to return a subject/id attribute","Test the full delegated flow per IdP in staging"],"tags":["authentication","pac4j","principal","delegated"],"backgroundTag":"empty-required-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}