{"record":{"id":"d7fa47bac25449ed","repo":"apereo/cas","slug":"username-not-found-with-sql-query-d7fa47","errorCode":null,"errorMessage":"[username] not found with SQL query.","messagePattern":"\\[username\\] not found with SQL query\\.","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-jdbc-authentication/src/main/java/org/apereo/cas/jdbc/SearchModeSearchDatabaseAuthenticationHandler.java","lineNumber":48,"sourceCode":"                                                         final PrincipalFactory principalFactory,\n                                                         final DataSource datasource) {\n        super(properties, principalFactory, datasource);\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential credential, final String originalPassword) throws Throwable {\n        val sql = \"SELECT COUNT('x') FROM \".concat(properties.getTableUsers())\n            .concat(\" WHERE \")\n            .concat(properties.getFieldUser())\n            .concat(\" = ? AND \")\n            .concat(properties.getFieldPassword()).concat(\"= ?\");\n        val username = credential.getUsername();\n        try {\n            LOGGER.debug(\"Executing SQL query [{}]\", sql);\n            val count = getJdbcTemplate().queryForObject(sql, Integer.class, username, credential.toPassword());\n            if (count == null || count == 0) {\n                throw new FailedLoginException(username + \" not found with SQL query.\");\n            }\n            val principal = principalFactory.createPrincipal(username);\n            return createHandlerResult(credential, principal, new ArrayList<>());\n        } catch (final Throwable e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new FailedLoginException(e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":30,"sourceCodeEnd":58,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-jdbc-authentication/src/main/java/org/apereo/cas/jdbc/SearchModeSearchDatabaseAuthenticationHandler.java#L30-L58","documentation":"SearchModeSearchDatabaseAuthenticationHandler authenticates by issuing a SELECT COUNT(*) WHERE username=? AND password=?. If the count is null or zero, no matching row exists and FailedLoginException 'not found with SQL query' is thrown.","triggerScenarios":"authenticateUsernamePasswordInternal runs the generated count query with (username, password); queryForObject returns 0/null because either the username is absent or the stored password hash does not match the supplied password.","commonSituations":"Wrong password; cas.authn.jdbc.search[].fieldPassword storing plaintext while CAS compares a hash (or vice versa, depending on passwordEncoder config); username case mismatch; wrong table.","solutions":["Confirm username/password are correct for the target table.","Align cas.authn.jdbc.search[].passwordEncoder/encryptionAlgorithm with how passwords are actually stored in the column.","Log and run the generated SQL manually to see which predicate fails.","Check fieldUser/fieldPassword properties point at real columns in the configured table."],"exampleFix":"// before: comparing raw password against md5-hashed column\ncas.authn.jdbc.search[0].fieldPassword=password\n// after: use the encoder matching storage\ncas.authn.jdbc.search[0].passwordEncoder.type=DEFAULT\ncas.authn.jdbc.search[0].passwordEncoder.characterEncoding=UTF-8\ncas.authn.jdbc.search[0].passwordEncoder.encodingAlgorithm=MD5","handlingStrategy":"validation","validationCode":"// Verify a row exists with the expected password scheme before auth\nInteger n = jdbcTemplate.queryForObject(\n  \"SELECT COUNT(*) FROM users WHERE username=?\", Integer.class, username);\nif (n == null || n == 0) { throw new AccountNotFoundException(username); }","typeGuard":null,"tryCatchPattern":"try { result = handler.authenticate(credential); }\ncatch (FailedLoginException e) { log.warn(\"Search-mode auth failed for user: {}\", credential.getUsername()); return genericAuthError(); }","preventionTips":["Match passwordEncoder/encodingAlgorithm to the column's stored format.","Test the generated count SQL manually for a known-good pair.","Confirm fieldUser/fieldPassword exist in the configured table."],"tags":["jdbc","sql","authentication","user-not-found"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}