{"record":{"id":"cc9f0b651ed18d50","repo":"apereo/cas","slug":"no-values-remaining-for-attribute","errorCode":null,"errorMessage":"No values remaining for attribute","messagePattern":"No values remaining for attribute","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509SubjectPrincipalResolver.java","lineNumber":127,"sourceCode":"\n    private static final class AttributeContext {\n\n        private final Object[] values;\n        private int currentIndex;\n\n        AttributeContext(final String[] values) {\n            this.values = ArrayUtils.clone(values);\n        }\n\n        /**\n         * Retrieve the next value, by incrementing the current index.\n         *\n         * @return the string\n         * @throws IllegalStateException if no values are remaining.\n         */\n        String nextValue() {\n            if (this.currentIndex == this.values.length) {\n                throw new IllegalStateException(\"No values remaining for attribute\");\n            }\n            val value = this.values[this.currentIndex].toString();\n            this.currentIndex++;\n            return value;\n        }\n    }\n}\n","sourceCodeStart":109,"sourceCodeEnd":135,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/principal/X509SubjectPrincipalResolver.java#L109-L135","documentation":"X509SubjectPrincipalResolver builds the principal from subject DN attribute values; nextValue() is the internal per-attribute iterator. When all values of the attribute are consumed and another is requested, it throws IllegalStateException('No values remaining for attribute'), an invariant violation meaning the resolver asked for more values than the DN provides.","triggerScenarios":"The subject DN contains fewer values for the configured principal attribute than the resolution logic iterates — e.g. a misconfigured/typo'd attribute name yields an empty or single-value array that the multi-value resolution still walks.","commonSituations":"principal-attribute configured to an attribute absent from client certificate DNs (e.g. SERIALNUMBER when certs have CN only); multi-value resolution mode combined with minimal subject DNs; DN layout changes after a CA migration.","solutions":["Correct the configured principal attribute so it matches attributes actually present in the certificate DNs.","Use single-value resolution (e.g. CN) for certificates with minimal subject DNs.","Log the full subject DN to confirm available attributes, then align configuration.","Ensure authentication failures from bad DNs surface as normal FailedLoginException rather than an uncaught IllegalStateException."],"exampleFix":"// before\ncas.authn.x509.principal.principal-attribute=SERIALNUMBER\n// after\ncas.authn.x509.principal.principal-attribute=CN","handlingStrategy":"type-guard","validationCode":"String dn = cert.getSubjectX500Principal().getName();\nLdapName name = new LdapName(dn);\nboolean hasAttr = name.getRdns().stream().anyMatch(rdn -> rdn.getType().equalsIgnoreCase(\"CN\"));\nif (!hasAttr) { reject(\"principal attribute absent from DN\"); }","typeGuard":"boolean dnHasAttribute(X509Certificate cert, String type) {\n    return cert.getSubjectX500Principal().getName(X500Principal.RFC2253).contains(type + \"=\");\n}","tryCatchPattern":"try {\n    principalResolver.resolve(credential);\n} catch (IllegalStateException e) {\n    // attribute values exhausted: fall back to a single-value attribute like CN\n}","preventionTips":["Verify the configured principal attribute exists in real client certificate DNs.","Prefer single-value attributes (CN) for minimal subject DNs.","Log the full DN when debugging principal resolution.","Re-check config after CA migrations that change DN layout."],"tags":["x509","principal-resolution","configuration","state"],"backgroundTag":"internal-invariant-violation","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}