{"record":{"id":"d28deac1e5a18f8c","repo":"apereo/cas","slug":"passwordless-account-does-not-have-the-requir","errorCode":null,"errorMessage":"Passwordless account [{}] does not have the required attribute [{}] with value pattern [{}]","messagePattern":"Passwordless account \\[(.+?)\\] does not have the required attribute \\[(.+?)\\] with value pattern \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-passwordless-ldap/src/main/java/org/apereo/cas/impl/account/LdapPasswordlessUserAccountStore.java","lineNumber":62,"sourceCode":"    public Optional<PasswordlessUserAccount> findUser(final PasswordlessAuthenticationRequest request) {\n        try {\n            val filter = LdapUtils.newLdaptiveSearchFilter(ldapProperties.getSearchFilter(),\n                LdapUtils.LDAP_SEARCH_FILTER_DEFAULT_PARAM_NAME,\n                CollectionUtils.wrap(request.getUsername()));\n\n            LOGGER.debug(\"Constructed LDAP filter [{}] to locate passwordless account\", filter);\n            val response = connectionFactory.executeSearchOperation(ldapProperties.getBaseDn(), filter, ldapProperties.getPageSize());\n            LOGGER.debug(\"LDAP response for passwordless account is [{}]\", response);\n\n            if (LdapUtils.containsResultEntry(response)) {\n                val passwordlessUserAccount = buildPasswordlessUserAccount(request, response);\n                LOGGER.debug(\"Final passwordless account is [{}]\", passwordlessUserAccount);\n\n                if (StringUtils.isNotBlank(ldapProperties.getRequiredAttribute())\n                    && StringUtils.isNotBlank(ldapProperties.getRequiredAttributeValue())) {\n                    val attributeValues = passwordlessUserAccount.getAttributes().getOrDefault(ldapProperties.getRequiredAttribute(), List.of());\n                    if (attributeValues.stream().noneMatch(value -> RegexUtils.find(ldapProperties.getRequiredAttributeValue(), value.toString()))) {\n                        LOGGER.warn(\"Passwordless account [{}] does not have the required attribute [{}] with value pattern [{}]\",\n                            passwordlessUserAccount, ldapProperties.getRequiredAttribute(), ldapProperties.getRequiredAttributeValue());\n                        return Optional.empty();\n                    }\n                }\n                val result = Optional.of(passwordlessUserAccount);\n                customizerList\n                    .stream()\n                    .filter(BeanSupplier::isNotProxy)\n                    .forEach(customizer -> customizer.customize(result));\n                return result;\n            }\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }\n        return Optional.empty();\n    }\n\n    protected PasswordlessUserAccount buildPasswordlessUserAccount(final PasswordlessAuthenticationRequest request,","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-passwordless-ldap/src/main/java/org/apereo/cas/impl/account/LdapPasswordlessUserAccountStore.java#L44-L80","documentation":"LdapPasswordlessUserAccountStore.findUser filters out accounts that lack the LDAP required attribute matching the required value regex; it logs this warning and returns Optional.empty, so CAS behaves as if the passwordless account does not exist.","triggerScenarios":"cas.authn.passwordless.accounts.ldap required-attribute and required-attribute-value are set, and none of the user's values for that attribute match the regex during findUser.","commonSituations":"User not in the required LDAP group; attribute not returned by the LDAP search filter/base DN; regex mismatch due to case or partial-match expectations; typos in attribute name.","solutions":["Confirm the user's LDAP entry contains the required attribute value (ldapsearch)","Verify cas.authn.passwordless.accounts.ldap.required-attribute and required-attribute-value settings","Check the LDAP search base/filter actually returns that attribute","Adjust the regex (RegexUtils.find does partial matching) to match real values"],"exampleFix":"// before\ncas.authn.passwordless.accounts.ldap.required-attribute-value=^pwdless$\n// after\ncas.authn.passwordless.accounts.ldap.required-attribute-value=passwordless-eligible","handlingStrategy":"validation","validationCode":"List<String> vals = ldapEntry.get(requiredAttribute);\nboolean ok = vals != null && vals.stream().anyMatch(v -> v != null && Pattern.compile(requiredValuePattern).matcher(v).find());","typeGuard":null,"tryCatchPattern":"store.findUser(id).orElseThrow(() -> new AccountNotFoundException(id));","preventionTips":["Validate LDAP attribute visibility with ldapsearch","Keep required-attribute/value in version-controlled config","Add smoke tests for representative accounts"],"tags":["passwordless","ldap","attributes"],"backgroundTag":"record-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}