{"record":{"id":"ff13958f631d8de8","repo":"apereo/cas","slug":"user-filter-cannot-be-empty-blank-for-authenticate","errorCode":null,"errorMessage":"User filter cannot be empty/blank for authenticated/anonymous authentication","messagePattern":"User filter cannot be empty/blank for authenticated/anonymous authentication","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/util/LdapUtils.java","lineNumber":788,"sourceCode":"                }\n                default -> searchResultHandlers.add(new MergeResultHandler());\n            }\n        });\n        return searchResultHandlers;\n    }\n\n    /**\n     * Gets authenticated authenticator.\n     *\n     * @param properties the lDAP properties\n     * @return the authenticated or anon search authenticator\n     */\n    public static Authenticator getAuthenticatedOrAnonSearchAuthenticator(final AbstractLdapAuthenticationProperties properties) {\n        if (StringUtils.isBlank(properties.getBaseDn())) {\n            throw new IllegalArgumentException(\"Base dn cannot be empty/blank for authenticated/anonymous authentication\");\n        }\n        if (StringUtils.isBlank(properties.getSearchFilter())) {\n            throw new IllegalArgumentException(\"User filter cannot be empty/blank for authenticated/anonymous authentication\");\n        }\n        val connectionFactory = newLdaptiveConnectionFactory(properties);\n        val resolver = buildAggregateDnResolver(properties, connectionFactory);\n\n        val auth = StringUtils.isBlank(properties.getPrincipalAttributePassword())\n            ? new Authenticator(resolver, getBindAuthenticationHandler(connectionFactory))\n            : new Authenticator(resolver, getCompareAuthenticationHandler(properties, connectionFactory));\n\n        if (properties.isEnhanceWithEntryResolver()) {\n            auth.setEntryResolver(newLdaptiveSearchEntryResolver(properties, connectionFactory));\n        }\n        return auth;\n    }\n\n    private static Authenticator getDnFormatAuthenticator(final AbstractLdapAuthenticationProperties properties) {\n        if (StringUtils.isBlank(properties.getDnFormat())) {\n            throw new IllegalArgumentException(\"Dn format cannot be empty/blank for authentication\");\n        }","sourceCodeStart":770,"sourceCodeEnd":806,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ldap-core/src/main/java/org/apereo/cas/util/LdapUtils.java#L770-L806","documentation":"Immediately after validating baseDn, getAuthenticatedOrAnonSearchAuthenticator requires a non-blank searchFilter (user filter) because the search-and-bind Authenticator needs a filter to locate the user entry. A blank filter triggers IllegalArgumentException.","triggerScenarios":"Authenticated/anonymous search configuration where cas.authn.ldap[x].search-filter (user-filter) is missing or empty when newLdaptiveAuthenticator builds the authenticator.","commonSituations":"Template-based config with search-filter commented out; assuming a default filter exists when none is applied; filter moved to the wrong config block after refactoring; programmatic AbstractLdapAuthenticationProperties built without setSearchFilter.","solutions":["Set cas.authn.ldap[x].search-filter to a valid filter, e.g. (uid={user}) or (sAMAccountName={user})","Confirm the filter is in the same ldap[x] block as the other authentication settings","Match the filter attribute to your directory's naming attribute"],"exampleFix":"// before\ncas.authn.ldap[0].search-filter=\n// after\ncas.authn.ldap[0].search-filter=(sAMAccountName={user})","handlingStrategy":"validation","validationCode":"if (props.getSearchFilter() == null || props.getSearchFilter().isBlank()) {\n    throw new IllegalStateException(\"search-filter is required for authenticated/anonymous LDAP search\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    Authenticator a = LdapUtils.newLdaptiveAuthenticator(props);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"User filter cannot be empty/blank\")) {\n        // abort wiring and report the missing search-filter config\n    }\n}","preventionTips":["Always define search-filter (e.g. (uid={user})) alongside base-dn","Keep the filter inside the same ldap[x] config block","Test the filter with ldapsearch against the target base DN","Prefer explicit configuration over relying on any implicit default filter"],"tags":["ldap","configuration","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}