{"record":{"id":"ba4d3d4445f921cb","repo":"apereo/cas","slug":"unable-to-authenticate-credential-getid","errorCode":null,"errorMessage":"Unable to authenticate ${credential.getId()}","messagePattern":"Unable to authenticate (.+?)","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java","lineNumber":79,"sourceCode":"            throw new FailedLoginException(\"No user can be accepted because none is defined\");\n        }\n        val username = credential.getUsername();\n        val cachedPassword = this.users.get(username);\n        if (cachedPassword == null) {\n            LOGGER.debug(\"[{}] was not found in the map.\", username);\n            throw new AccountNotFoundException(username + \" not found in backing map.\");\n        }\n        if (!Strings.CS.equals(credential.toPassword(), cachedPassword)) {\n            throw new FailedLoginException();\n        }\n        val strategy = getPasswordPolicyHandlingStrategy();\n        if (strategy != null && StringUtils.isNotBlank(username)) {\n            LOGGER.debug(\"Attempting to examine and handle password policy via [{}]\", strategy.getClass().getSimpleName());\n            val principal = this.principalFactory.createPrincipal(username);\n            val messageList = strategy.handle(principal, getPasswordPolicyConfiguration());\n            return createHandlerResult(credential, principal, messageList);\n        }\n        throw new FailedLoginException(\"Unable to authenticate \" + credential.getId());\n    }\n}\n","sourceCodeStart":61,"sourceCodeEnd":82,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/AcceptUsersAuthenticationHandler.java#L61-L82","documentation":"Fallback failure in AcceptUsersAuthenticationHandler: after the password check, if no password-policy strategy applies (strategy null or username blank), the handler cannot build a handler result and throws FailedLoginException('Unable to authenticate ' + credential.getId()). It marks any remaining/unexpected path as an authentication failure.","triggerScenarios":"authenticateUsernamePasswordInternal reaches the final throw because getPasswordPolicyHandlingStrategy() returned null or the username was blank, even though the password comparison passed — an edge path triggered by a blank username or missing policy strategy.","commonSituations":"Custom configurations where the password policy handling strategy bean is absent; credentials submitted with blank usernames that somehow reached the handler.","solutions":["Ensure the credential carries a non-blank username before reaching the handler","Configure a password policy handling strategy (or accept the default) so a handler result can be built","If this fires despite a valid username/password, debug getPasswordPolicyHandlingStrategy() wiring"],"exampleFix":"// before\nUsernamePasswordCredential c = new UsernamePasswordCredential(); c.setPassword(p); // username blank\n// after\nc.setUsername(username); // ensure username is set before authentication","handlingStrategy":"validation","validationCode":"// before authentication\nif (credential.getUsername() == null || credential.getUsername().isBlank()) {\n    throw new IllegalArgumentException(\"Username must not be blank\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    handlerResult = acceptUsersHandler.authenticate(credential, service);\n} catch (FailedLoginException e) {\n    if (e.getMessage() != null && e.getMessage().startsWith(\"Unable to authenticate\")) {\n        LOGGER.error(\"Handler could not build a result; check password policy strategy configuration\");\n    }\n}","preventionTips":["Always set the username on the credential before authentication","Ensure a password policy handling strategy is configured or default one is present","Treat this exception as a configuration smell; investigate rather than masking"],"tags":["java","authentication","password-policy"],"backgroundTag":"invalid-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}