{"record":{"id":"de323fe91a51940e","repo":"apereo/cas","slug":"authentication-did-not-produce-a-user-profile-for","errorCode":null,"errorMessage":"Authentication did not produce a user profile for: ","messagePattern":"Authentication did not produce a user profile for: ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java","lineNumber":55,"sourceCode":"    protected final SessionStore sessionStore;\n\n    protected String principalAttributeId;\n\n    protected boolean isTypedIdUsed;\n\n    protected BaseDelegatedClientAuthenticationHandler(final String name,\n                                                       final PrincipalFactory principalFactory, final Integer order,\n                                                       final SessionStore sessionStore) {\n        super(name, principalFactory, order);\n        this.sessionStore = sessionStore;\n    }\n\n    protected AuthenticationHandlerExecutionResult createResult(final ClientCredential credentials,\n                                                                final UserProfile profile,\n                                                                final BaseClient client,\n                                                                final Service service) throws Throwable {\n        if (profile == null) {\n            throw new FailedLoginException(\"Authentication did not produce a user profile for: \" + credentials);\n        }\n\n        val extractedCredential = new BasicIdentifiableCredential(determinePrincipalIdFrom(profile, client));\n        val id = transformUsername(extractedCredential);\n        if (StringUtils.isBlank(id)) {\n            throw new FailedLoginException(\"No identifier found for this user profile: \" + profile);\n        }\n        credentials.setUserProfile(profile);\n        credentials.setTypedIdUsed(isTypedIdUsed);\n        val attributes = CollectionUtils.toMultiValuedMap(profile.getAttributes());\n        attributes.put(Pac4jConstants.CLIENT_NAME, CollectionUtils.wrap(profile.getClientName()));\n        if (profile instanceof final BasicUserProfile bup) {\n            attributes.putAll(CollectionUtils.toMultiValuedMap(bup.getAuthenticationAttributes()));\n        }\n        val initialPrincipal = Objects.requireNonNull(principalFactory.createPrincipal(id, attributes));\n        val principal = finalizeAuthenticationPrincipal(initialPrincipal, client, credentials, service);\n        LOGGER.debug(\"Constructed authenticated principal [{}] based on user profile [{}]\", principal, profile);\n        return finalizeAuthenticationHandlerResult(credentials, principal, profile, client, service);","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core-clients/src/main/java/org/apereo/cas/support/pac4j/authentication/handler/support/BaseDelegatedClientAuthenticationHandler.java#L37-L73","documentation":"BaseDelegatedClientAuthenticationHandler.createResult throws FailedLoginException when the delegated (pac4j) client authentication returned a null UserProfile. Without a profile there is no user to build an AuthenticationHandlerExecutionResult from.","triggerScenarios":"A callback from the delegated identity provider reaches createResult with profile == null — e.g. the IdP response lacked the data pac4j needs, the client's profile extractor failed silently, or the callback was forged/invalid so no session profile could be restored.","commonSituations":"Misconfigured delegated client (bad callback URL/credentials) causing the IdP to return an error page instead of profile data; IdP protocol version changes breaking profile extraction; users hitting the callback endpoint directly without completing the flow.","solutions":["Check CAS logs for the underlying pac4j client errors before this handler to find why the profile is null","Verify the delegated client configuration (client ID/secret, callback URL) with the identity provider","Reproduce the IdP callback manually and confirm it returns a profile the pac4j client can extract"],"exampleFix":"// before\ncas.authn.pac4j.oidc[0].generic.client-id=<wrong>\ncas.authn.pac4j.oidc[0].generic.discovery-uri=https://bad-idp.example.org/.well-known/openid-configuration\n// after\ncas.authn.pac4j.oidc[0].generic.client-id=real-client-id\ncas.authn.pac4j.oidc[0].generic.discovery-uri=https://real-idp.example.org/.well-known/openid-configuration","handlingStrategy":"try-catch","validationCode":"if (profile == null) { failFast(\"no profile from IdP callback\"); }","typeGuard":null,"tryCatchPattern":"try { result = handler.createResult(credentials, profile, client, service); }\ncatch (FailedLoginException e) { redirect to error page and inspect pac4j logs for the IdP failure; }","preventionTips":["Keep pac4j client configs (secrets, callback URLs) verified against the IdP","Log full callback parameters in a debug profile","Upgrade pac4j/CAS together when IdP protocol versions change"],"tags":["authentication","pac4j","delegated","user-profile"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}