{"record":{"id":"efd528382b441a99","repo":"apereo/cas","slug":"passwordless-account-does-not-require-a-passw","errorCode":null,"errorMessage":"Passwordless account [{}] does not require a password","messagePattern":"Passwordless account \\[(.+?)\\] does not require a password","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java","lineNumber":47,"sourceCode":"                                                 final MultifactorAuthenticationTriggerSelectionStrategy multifactorTriggerSelectionStrategy,\n                                                 final PrincipalFactory passwordlessPrincipalFactory,\n                                                 final AuthenticationSystemSupport authenticationSystemSupport) {\n        super(casProperties, multifactorTriggerSelectionStrategy, passwordlessPrincipalFactory, authenticationSystemSupport);\n        this.passwordlessUserAccountStore = passwordlessUserAccountStore;\n    }\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n\n        if (!user.isAllowSelectionMenu()) {\n            LOGGER.error(\"Passwordless account [{}] is not allowed to select options\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n\n        val selection = extractSelectedAuthenticationOption(requestContext);\n        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not require a password\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow delegated authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow multifactor authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        return buildFinalSelectionEvent(requestContext, selection);\n    }\n\n    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {\n        val finalEvent = switch (selection) {\n            case PASSWORD -> {\n                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java#L29-L65","documentation":"AcceptPasswordlessSelectionMenuAction rejects the user's menu selection of PASSWORD when the passwordless account is configured as passwordless-only (doesPasswordlessAccountRequestPassword is false); it logs this warning and routes to an error event instead of the password flow.","triggerScenarios":"User selects the PASSWORD option in the passwordless selection menu while the resolved PasswordlessUserAccount indicates no password is required (e.g. account is delegated/MFA only).","commonSituations":"Stale UI state showing the password option after account config changed; user manipulating request parameters to force the password option; menu options not derived from the account definition.","solutions":["Verify the passwordless account definition requires a password (passwordless mode setting in the user account store)","Have the user choose the correct option (delegation or MFA)","Refresh/restart the flow so the menu only presents valid options","Check custom PasswordlessUserAccountCustomizer logic overriding the password flag"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if (selection == PasswordlessSelectionMenu.PASSWORD && !account.isRequestPassword()) renderMenuAgain(account);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Render menu options strictly from the account definition","Avoid caching selection pages across users","Handle the error event with a friendly retry page"],"tags":["passwordless","webflow","user-input"],"backgroundTag":"invalid-state-transition","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}