shuzheng/zheng · warning · UnknownAccountException

UnknownAccountException

Error message

UnknownAccountException

What it means

UpmsRealm (Apache Shiro realm) throws Shiro's UnknownAccountException during doGetAuthenticationInfo when no UpmsUser exists in the database for the submitted username. It signals the login attempt used an account that does not exist.

Source

Thrown at zheng-upms/zheng-upms-client/src/main/java/com/zheng/upms/client/shiro/realm/UpmsRealm.java:88

     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String username = (String) authenticationToken.getPrincipal();
        String password = new String((char[]) authenticationToken.getCredentials());
        // client无密认证
        String upmsType = PropertiesFileUtil.getInstance("zheng-upms-client").get("zheng.upms.type");
        if ("client".equals(upmsType)) {
            return new SimpleAuthenticationInfo(username, password, getName());
        }

        // 查询用户信息
        UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);

        if (null == upmsUser) {
            throw new UnknownAccountException();
        }
        if (!upmsUser.getPassword().equals(MD5Util.md5(password + upmsUser.getSalt()))) {
            throw new IncorrectCredentialsException();
        }
        if (upmsUser.getLocked() == 1) {
            throw new LockedAccountException();
        }

        return new SimpleAuthenticationInfo(username, password, getName());
    }

}

View on GitHub (pinned to 7005c0a775)

Solutions

1. Check the username for typos/case and retry with a registered account.
2. Verify the upms_user table contains a row with that username (SELECT * FROM upms_user WHERE username = ...).
3. Confirm the client connects to the intended database (correct datasource URL/env).
4. Handle UnknownAccountException in the login controller and show a generic 'invalid credentials' message to avoid user enumeration.

Example fix

// before
User user = userService.login(username, password); // may throw UnknownAccountException
// after
try {
    currentUser.login(token);
} catch (UnknownAccountException uae) {
    model.addAttribute("error", "账号不存在");
    return "login";
}

// pre-check without Shiro
UpmsUser u = upmsApiService.selectUpmsUserByUsername(username);
if (u == null) {
    // show 'invalid username or password' before attempting login
}

boolean accountExists(String username) {
    return upmsApiService.selectUpmsUserByUsername(username) != null;
}

try {
    currentUser.login(token);
} catch (UnknownAccountException e) {
    model.addAttribute("error", "账号或密码错误"); // avoid revealing account existence
    return "login";
}

When it happens

Trigger: Subject.login(new UsernamePasswordToken(username, password)) where upmsApiService.selectUpmsUserByUsername(username) returns null — i.e. the username is not present in the upms_user table.

Common situations: User typed the wrong username; test data was not seeded into the UPMS database; app connects to a different DB/environment than where the account was created; case-sensitivity or whitespace in the submitted username.

Related errors

• LockedAccountException
• IncorrectCredentialsException

AI-assisted analysis of shuzheng/zheng@7005c0a775 (2026-09-04). Data as JSON: /api/errors/7242824558f56160. Report an issue: GitHub.