{"record":{"id":"ade33a219fc33105","repo":"apereo/cas","slug":"using-no-op-password-change-implementation-approp","errorCode":null,"errorMessage":"Using no-op password change implementation. Appropriate password management service is not configured.","messagePattern":"Using no-op password change implementation\\. Appropriate password management service is not configured\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pm-core/src/main/java/org/apereo/cas/pm/impl/NoOpPasswordManagementService.java","lineNumber":25,"sourceCode":"import org.apereo.cas.util.crypto.CipherExecutor;\nimport lombok.extern.slf4j.Slf4j;\n\n/**\n * This is {@link NoOpPasswordManagementService}.\n *\n * @author Misagh Moayyed\n * @since 5.1.0\n */\n@Slf4j\npublic class NoOpPasswordManagementService extends BasePasswordManagementService {\n    public NoOpPasswordManagementService(final CipherExecutor<Serializable, String> cipherExecutor,\n                                         final CasConfigurationProperties casProperties) {\n        super(casProperties, cipherExecutor, new InMemoryPasswordHistoryService());\n    }\n\n    @Override\n    public boolean changeInternal(final PasswordChangeRequest bean) {\n        LOGGER.warn(\"Using no-op password change implementation. Appropriate password management service is not configured.\");\n        return false;\n    }\n}\n","sourceCodeStart":7,"sourceCodeEnd":29,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pm-core/src/main/java/org/apereo/cas/pm/impl/NoOpPasswordManagementService.java#L7-L29","documentation":"NoOpPasswordManagementService is the fallback PasswordManagementService installed when no real password-management backend (LDAP, JDBC, REST) is configured. Its changeInternal logs this warn and returns false, meaning every password change attempt silently does nothing — the user is told the change failed.","triggerScenarios":"Password reset flow reaches the change step while no cas.authn.pm.* backend module (pm-ldap, pm-jdbc, pm-rest) is on the classpath/configured, so CAS wires the no-op implementation.","commonSituations":"cas.authn.pm.enabled=true but no implementation module added to the build; LDAP PM module present but connection properties missing so the fallback is used; overlay copied without the pm dependency.","solutions":["Add the appropriate password-management module (cas-server-support-pm-ldap, -jdbc, or -rest) to the build","Configure cas.authn.pm.ldap/jdbc/rest connection and search settings so the real service bean is created","Disable cas.authn.pm.enabled if password management is not intended","Verify at startup that the active PasswordManagementService bean is not NoOpPasswordManagementService"],"exampleFix":"// before\nimplementation \"org.apereo.cas:cas-server-support-pm-webflow\"\n// after\nimplementation \"org.apereo.cas:cas-server-support-pm-webflow\"\nimplementation \"org.apereo.cas:cas-server-support-pm-ldap\"\n// plus cas.authn.pm.ldap[0].ldapUrl=... etc.","handlingStrategy":"validation","validationCode":"// at startup, fail fast if PM is enabled but no-op\nif (casProperties.getAuthn().getPm().isEnabled()\n    && passwordManagementService instanceof NoOpPasswordManagementService) {\n    throw new IllegalStateException(\"PM enabled but only the no-op service is configured\");\n}","typeGuard":"boolean isNoOpPmService(PasswordManagementService svc) {\n    return svc instanceof NoOpPasswordManagementService;\n}","tryCatchPattern":"try { pmService.change(changeRequest); }\ncatch (Exception e) { log.error(\"Password change failed\", e); }\n// always check the boolean result — no-op returns false","preventionTips":["Add a PM implementation module whenever cas.authn.pm.enabled=true","Assert the active bean type in a startup health check","Monitor changeInternal returning false as an indicator of a no-op deployment"],"tags":["password-management","no-op","configuration","missing-dependency"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}