{"record":{"id":"c814f1fc02daee6f","repo":"apereo/cas","slug":"no-custom-principal-attribute-was-provided-by-the","errorCode":null,"errorMessage":"No custom principal attribute was provided by the client [{}]. Using the default id [{}]","messagePattern":"No custom principal attribute was provided by the client \\[(.+?)\\]\\. Using the default id \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java","lineNumber":122,"sourceCode":"    protected String determinePrincipalIdFrom(final UserProfile profile, final BaseClient client) {\n        var id = profile.getId();\n        val properties = client != null ? client.getCustomProperties() : new HashMap<>();\n        if (client != null && properties.containsKey(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID)) {\n            val attrObject = properties.get(ClientCustomPropertyConstants.CLIENT_CUSTOM_PROPERTY_PRINCIPAL_ATTRIBUTE_ID);\n            if (attrObject != null) {\n                val principalAttribute = attrObject.toString();\n                if (profile.containsAttribute(principalAttribute)) {\n                    val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttribute));\n                    if (firstAttribute.isPresent()) {\n                        id = firstAttribute.get().toString();\n                        id = typePrincipalId(id, profile);\n                    }\n                    LOGGER.debug(\"Authentication indicates usage of client principal attribute [{}] for the identifier [{}]\", principalAttribute, id);\n                } else {\n                    LOGGER.warn(\"Authentication cannot find attribute [{}] to use as principal id\", principalAttribute);\n                }\n            } else {\n                LOGGER.warn(\"No custom principal attribute was provided by the client [{}]. Using the default id [{}]\", client, id);\n            }\n        } else if (StringUtils.isNotBlank(principalAttributeId)) {\n            if (profile.containsAttribute(principalAttributeId)) {\n                val firstAttribute = CollectionUtils.firstElement(profile.getAttribute(principalAttributeId));\n                if (firstAttribute.isPresent()) {\n                    id = firstAttribute.get().toString();\n                    id = typePrincipalId(id, profile);\n                }\n            } else {\n                LOGGER.warn(\"CAS cannot use [{}] as the principal attribute id, since the profile attributes do not contain the attribute. \"\n                    + \"Either adjust the CAS configuration to use a different attribute, or contact the authentication provider noted by [{}] \"\n                    + \"to release the expected attribute to CAS\", principalAttributeId, profile.getAttributes());\n            }\n            LOGGER.debug(\"Authentication indicates usage of attribute [{}] for the identifier [{}]\", principalAttributeId, id);\n        } else if (isTypedIdUsed) {\n            id = profile.getTypedId();\n            LOGGER.debug(\"Authentication indicates usage of typed profile id [{}]\", id);\n        }","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java#L104-L140","documentation":"BaseDelegatedClientAuthenticationHandler.determinePrincipalIdFrom logs this warning when the pac4j client reports a custom principal attribute type (principalAttribute set on the client/profile), yet the client did not actually supply that attribute, so CAS falls back to the profile's default identifier. Authentication still succeeds; only the principal-id source differs from the requested one.","triggerScenarios":"The pac4j client's principal attribute is configured (client's principalAttribute non-blank) but the returned profile lacks the attribute value (the else branch when firstAttribute/attribute is absent), during determinePrincipalIdFrom called via extractedCredential in delegated client authentication.","commonSituations":"Provider not releasing the configured client principal attribute; misconfigured client-level principal attribute name; providers returning thin profiles (e.g. implicit flow with minimal claims).","solutions":["Configure the provider to release the expected attribute (scopes/claims/attribute-release policy).","Fix the client's principal attribute name so it matches an attribute present in the profile.","Accept the default id and silence the warning by removing the client principal-attribute configuration if the default typed id is acceptable."],"exampleFix":"// before (client config requesting an attribute the IdP never sends)\nclient.setPrincipalAttribute(\"sub\"); // sub not in profile\n// after\nclient.setPrincipalAttribute(\"email\"); // email present in profile","handlingStrategy":"validation","validationCode":"if (StringUtils.isNotBlank(clientPrincipalAttribute) && !profile.containsAttribute(clientPrincipalAttribute)) {\n    // request the attribute via provider scopes or correct the name\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Match client principalAttribute names against actually-released profile attributes.","Request required claims/scopes from the IdP in client configuration."],"tags":["pac4j","delegated-authentication","principal-attribute","attribute-release"],"backgroundTag":"attribute-not-released","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}