{"record":{"id":"df7852d07f12993e","repo":"apereo/cas","slug":"unable-to-locate-registration-record-for","errorCode":null,"errorMessage":"Unable to locate registration record for ","messagePattern":"Unable to locate registration record for ","errorType":"exception","errorClass":"AccountNotFoundException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-webauthn-core-webflow/src/main/java/org/apereo/cas/webauthn/WebAuthnAuthenticationHandler.java","lineNumber":65,"sourceCode":"    public boolean supports(final Credential credential) {\n        return WebAuthnCredential.class.isAssignableFrom(credential.getClass());\n    }\n\n    @Override\n    public boolean supports(final Class<? extends Credential> clazz) {\n        return WebAuthnCredential.class.isAssignableFrom(clazz);\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential, final Service service) throws Throwable {\n        val webAuthnCredential = (WebAuthnCredential) credential;\n        val authentication = Objects.requireNonNull(WebUtils.getInProgressAuthentication(),\n            \"CAS has no reference to an authentication event to locate a principal\");\n        val principal = authentication.getPrincipal();\n        val uid = principal.getId();\n        val credentials = webAuthnCredentialRepository.getCredentialIdsForUsername(principal.getId());\n        if (credentials.isEmpty()) {\n            throw new AccountNotFoundException(\"Unable to locate registration record for \" + uid);\n        }\n        return createHandlerResult(webAuthnCredential, this.principalFactory.createPrincipal(uid));\n    }\n}\n","sourceCodeStart":47,"sourceCodeEnd":70,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-webauthn-core-webflow/src/main/java/org/apereo/cas/webauthn/WebAuthnAuthenticationHandler.java#L47-L70","documentation":"WebAuthnAuthenticationHandler.doAuthentication() looks up registered WebAuthn credentials for the authenticated principal's username via the credential repository. If the user has no registered credential records, it throws AccountNotFoundException — the user cannot perform WebAuthn authentication because no registration exists.","triggerScenarios":"Presenting a webauthn credential to the handler when webAuthnCredentialRepository.getCredentialIdsForUsername(uid) returns an empty list — i.e. the username has zero registered authenticators at authentication time.","commonSituations":"User never completed WebAuthn registration but the webflow allowed credential submission; registration data store changed (different MongoDB/JDBC/Redis backend or database reset) so prior registrations are missing; username mismatch (case or principal id transformation) between registration and authentication; multiple devices out of sync.","solutions":["Complete WebAuthn device registration for the user before attempting WebAuthn authentication","Verify the credential repository configuration points to the same storage used during registration (check cas.authn.mfa.webauthn.* backend settings and data contents)","Check for username normalization/case differences between the registered record and the authenticating principal id","If registrations were lost due to a data reset, re-register devices"],"exampleFix":"// before\nreturn createHandlerResult(webAuthnCredential, ...); // throws AccountNotFoundException if unregistered\n// after\nvar creds = webAuthnCredentialRepository.getCredentialIdsForUsername(uid);\nif (creds.isEmpty()) {\n    throw new AccountNotFoundException(\"No WebAuthn registration for \" + uid + \"; register a device first\");\n}\nreturn createHandlerResult(webAuthnCredential, ...);","handlingStrategy":"validation","validationCode":"boolean registered = !webAuthnCredentialRepository.getCredentialIdsForUsername(principal.getId()).isEmpty();\nif (!registered) {\n    // route user to registration flow instead of authentication\n}","typeGuard":null,"tryCatchPattern":"try {\n    return handler.authenticate(credential);\n} catch (AccountNotFoundException e) {\n    // redirect the user to WebAuthn device registration\n    return redirectToWebAuthnRegistration(e.getMessage());\n}","preventionTips":["Enforce registration completion in the webflow before offering WebAuthn authentication","Use the same storage backend and username normalization for registration and authentication","Monitor for empty credential collections after environment migrations or DB resets","Match principal id transformation rules between MFA registration and handler"],"tags":["webauthn","mfa","account-not-found","registration"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}