{"record":{"id":"e1f2de9412c84313","repo":"apereo/cas","slug":"unable-to-find-account-the-account-does-not-e1f2de","errorCode":null,"errorMessage":"Unable to find account [{}]: The account does not exist or it's missing username/password attributes","messagePattern":"Unable to find account \\[(.+?)\\]: The account does not exist or it's missing username/password attributes","errorType":"exception","errorClass":"AccountNotFoundException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java","lineNumber":45,"sourceCode":"                                                     final AmazonCloudDirectoryRepository repository,\n                                                     final AmazonCloudDirectoryProperties cloudDirectoryProperties) {\n        super(name, principalFactory, cloudDirectoryProperties.getOrder());\n        this.repository = repository;\n        this.cloudDirectoryProperties = cloudDirectoryProperties;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential,\n                                                                                        @Nullable final String originalPassword) throws Throwable {\n\n        val username = credential.getUsername();\n\n        val attributes = repository.getUser(username);\n\n        if (attributes == null || attributes.isEmpty()\n            || !attributes.containsKey(cloudDirectoryProperties.getUsernameAttributeName())\n            || !attributes.containsKey(cloudDirectoryProperties.getPasswordAttributeName())) {\n            LOGGER.warn(\"Unable to find account [{}]: The account does not exist or it's missing username/password attributes\", username);\n            throw new AccountNotFoundException();\n        }\n\n        LOGGER.debug(\"Located account attributes [{}] for [{}]\", attributes.keySet(), username);\n\n        val userPassword = attributes.get(cloudDirectoryProperties.getPasswordAttributeName()).getFirst().toString();\n        if (!matches(Objects.requireNonNull(originalPassword), userPassword)) {\n            LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", username);\n            throw new FailedLoginException();\n        }\n        val principal = this.principalFactory.createPrincipal(username, attributes);\n        return createHandlerResult(credential, principal, new ArrayList<>());\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":60,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-cloud-directory-authentication/src/main/java/org/apereo/cas/authentication/AmazonCloudDirectoryAuthenticationHandler.java#L27-L60","documentation":"AmazonCloudDirectoryAuthenticationHandler logs this warning when the AWS Cloud Directory user lookup returns null/empty attributes or lacks the configured username/password attribute names, so authentication cannot proceed and AccountNotFoundException is thrown.","triggerScenarios":"authenticateUsernamePasswordInternal calls repository.getUser(username); attributes are null/empty or missing cloud-directory username-attribute / password-attribute keys, producing AccountNotFoundException.","commonSituations":"User not present in the configured Cloud Directory schema/facet; attribute names in cas.authn.amazon-cloud-directory do not match the actual facet attribute names; wrong directory ARN or path configured; IAM permissions silently limiting lookup results.","solutions":["Confirm the user exists in the AWS Cloud Directory at the configured directory path.","Check username-attribute and password-attribute names match the Cloud Directory facet attributes exactly.","Verify the directory ARN and schema configuration in cas.authn.cloud-directory properties.","Ensure the AWS credentials/IAM policy allow reading objects and facet attributes from the directory."],"exampleFix":"// before\ncas.authn.cloud-directory.username-attribute=name\n// after (matches facet attribute)\ncas.authn.cloud-directory.username-attribute=UserName\ncas.authn.cloud-directory.password-attribute=Password","handlingStrategy":"try-catch","validationCode":"// before authenticating, verify user attributes via CloudDirectory API\nListObjectsRequest req = ...; // path to user\nif (lookupUser(username) == null) throw new AccountNotFoundException(username);","typeGuard":"function hasRequiredAttributes(attrs: Record<string, string[]> | null, u: string, p: string): attrs is Record<string, string[]> {\n  return !!attrs && u in attrs && p in attrs;\n}","tryCatchPattern":"try {\n  return cloudDirectoryHandler.authenticate(credential);\n} catch (AccountNotFoundException e) {\n  LOGGER.warn(\"Unknown user [{}] in Cloud Directory\", credential.getUsername());\n  return AuthenticationHandlerResult.failed(credential, e);\n}","preventionTips":["Verify attribute names in cas.authn.cloud-directory match the Cloud Directory facet schema.","Confirm the directory ARN/path and AWS credentials/IAM read permissions.","Provision test users and assert lookup succeeds before go-live.","Watch Cloud Directory API errors/metrics for silent lookup failures."],"tags":["aws","cloud-directory","authentication","account-not-found"],"backgroundTag":"user-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}