What causes "No principal was found in the response from the CAS server." in jeecgboot/JeecgBoot?

Inspect the raw CAS response (the 'res.' log line) to see what was actually returned.

jeecgboot/JeecgBoot · error · Exception

No principal was found in the response from the CAS server.

Error message

No principal was found in the response from the CAS server.

What it means

CasClientController.validateLogin() validates a CAS service ticket. After confirming the CAS response has no 'authenticationFailure', it extracts the 'user' element (the principal). If empty/absent, it throws -- meaning the CAS server validated the ticket but returned no user identity.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/cas/controller/CasClientController.java:72

	
	@GetMapping("/validateLogin")
	public Object validateLogin(@RequestParam(name="ticket") String ticket,
								@RequestParam(name="service") String service,
								HttpServletRequest request,
								HttpServletResponse response) throws Exception {
		Result<JSONObject> result = new Result<JSONObject>();
		log.info("Rest api login.");
		try {
			String validateUrl = prefixUrl+"/p3/serviceValidate";
			String res = CasServiceUtil.getStValidate(validateUrl, ticket, service);
			log.info("res."+res);
			final String error = XmlUtils.getTextForElement(res, "authenticationFailure");
			if(StringUtils.isNotEmpty(error)) {
				throw new Exception(error);
			}
			final String principal = XmlUtils.getTextForElement(res, "user");
			if (StringUtils.isEmpty(principal)) {
	            throw new Exception("No principal was found in the response from the CAS server.");
	        }
			log.info("-------token----username---"+principal);
		    //1. 校验用户是否有效
	  		SysUser sysUser = sysUserService.getUserByName(principal);
	  		result = sysUserService.checkUserIsEffective(sysUser);
	  		if(!result.isSuccess()) {
	  			return result;
	  		}
	 		String token = JwtUtil.sign(sysUser.getUsername(), sysUser.getPassword(), CommonConstant.CLIENT_TYPE_PC);
	 		// 设置超时时间
	 		redisUtil.set(CommonConstant.PREFIX_USER_TOKEN + token, token);
	 		redisUtil.expire(CommonConstant.PREFIX_USER_TOKEN + token, JwtUtil.EXPIRE_TIME*2 / 1000);

	 		//获取用户部门信息
			JSONObject obj = new JSONObject();
			List<SysDepart> departs = sysDepartService.queryUserDeparts(sysUser.getId());
			obj.put("departs", departs);
			if (departs == null || departs.size() == 0) {

View on GitHub (pinned to 96fb33f5ec)

Solutions

Inspect the raw CAS response (the 'res.' log line) to see what was actually returned.
Configure the CAS service registry to release the username attribute (service attribute release policy).
Ensure the 'service' parameter exactly matches the registered CAS service URL.
Use a fresh, unconsumed ticket; do not replay a ticket across requests.
Verify prefixUrl + '/p3/serviceValidate' is the correct validation endpoint for the CAS version.

Defensive patterns

Strategy: validation

Validate before calling

// pre-flight: confirm CAS service registration releases the user attribute
String res = CasServiceUtil.getStValidate(validateUrl, ticket, service);
String error = XmlUtils.getTextForElement(res, "authenticationFailure");
String principal = XmlUtils.getTextForElement(res, "user");
if (StringUtils.isEmpty(principal)) {
    log.error("CAS 未返回 principal，原始响应: {}", res);
}

Try / catch

try {
    // validate CAS ticket
} catch (Exception e) {
    if (e.getMessage().contains("No principal was found")) {
        return Result.error("CAS 未返回用户信息，请检查服务注册的属性释放策略");
    }
    throw e;
}

Prevention

Register the exact service URL in CAS and enable attribute release.
Always use a fresh ticket per login attempt.
Log the raw CAS response for diagnostics.

When it happens

Trigger: CAS server returns a success response without a 'user' element; the service registry on CAS doesn't release the username attribute; service param doesn't match the registered service; ticket was already consumed or expired (but produced an unexpected response shape).

Common situations: CAS attribute-release policy not configured for this service; service URL mismatch between request and CAS service registration; stale/replayed ticket; CAS server version returns attributes in a different element.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/b1d48d29b3dcc606. Report an issue: GitHub.