title: WSO2 Identity Server 5.3.0 user store: List users and login works, but claim manager won't find user
body: <p>I've installed WSO2 Identity Server 5.3.0 and configured it with an Active Directory as primary user store. 
  Everything worked fine and there were no issues until now. Now it behaves super strange.</p>
  
  <p>I can list all users easily in the IS. I can edit their profile data. I can also use SAML to login from other applications.
  If I login with a user through SAML, the user is authenticated and then I get the following error in the IS:</p>
  
  <pre><code>ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  Error occurred while retrieving http://wso2.org/claims/emailaddress claim value for user user@domain.com
  org.wso2.carbon.user.core.UserStoreException: UserNotFound: User user@domain.com does not exist in: PRIMARY
  WARN {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  Subject claim could not be found amongst unfiltered local claims
  DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  Returning claims from claim handler = []
  DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  UNFILTERED_IDP_CLAIM_VALUES map property set to []
  DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  UNFILTERED_LOCAL_CLAIM_VALUES map property set to []
  DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  UNFILTERED_SP_CLAIM_VALUES map property set to []
  WARN {org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler} -  Subject claim could not be found. Defaulting to Name Identifier.
  </code></pre>
  
  <p>The login goes through as normal, but all the attributes I need in the SAML response are missing. (A day ago this still worked) </p>
  
  <p>Does anyone know where I could start to fix this?
  I had a look at the claim mappings, and couldn't find anything that looks wrong. Is it possible to reset the claim mappings to default? </p>
  
  <p>I also deleted and recreated the service providers and it didn't help.</p>
  
  <p>I checked the user-mgt.xml (especially the UserNameSearchFilter) and everything seems to work fine (otherwise it would not display all the users in IS).</p>
  
  <p><strong>UPDATE:</strong> </p>
  
  <p>Some new information:
  So I used a second WSO2 IS to check if the problem is in the IS or the AD. The second IS has no problem getting the claims during Login. </p>
  
  <p>So it has to be a configuration related issue.</p>
  
  <p><strong>UPDATE 2:</strong></p>
  
  <p>So I played around with log levels and found the following:</p>
  
  <pre><code>DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user user@domain.com
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user with SearchFilter: (&amp;(objectClass=user)(mail=user@domain.com )) in SearchBase: 
  
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Name in space for user@domain.com  is null
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  User: user@domain.com  exist: false
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user user@domain.com
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user with SearchFilter: (&amp;(objectClass=user)(mail=user@domain.com )) in SearchBase: 
  
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Name in space for user@domain.com  is null
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  User: user@domain.com  exist: false
  ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} -  Error occurred while retrieving http://wso2.org/claims/emailaddress claim value for user user@domain.com
  </code></pre>
  
  <p>Could the trailing whitespace in the Search Filter be a problem? (and where does it come from? My filter in the user-mgt.xml is without space and the exact same configuration works on a different server) </p>
  
  <p>Especially since it works when I open the user profile:</p>
  
  <pre><code>DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user user@domain.com
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  value after escaping special characters in user@domain.com : user@domain.com
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  User: user@domain.com exist: true
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Searching for user with SearchFilter: (&amp;(objectClass=user)(mail=user@domain.com)) in SearchBase:
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :telephoneNumber
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :role
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :mail
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :givenName
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :mobile
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :profileConfiguration
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :company
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :sn
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :cn
  DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  Requesting attribute :co
  </code></pre>
  
  <p>It also works on my second test IS. However there is one difference in the test IS which is not done on my main IS during login: </p>
  
  <pre><code>DEBUG {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager} -  value after escaping special characters in user@domain.com : user@domain.com
  </code></pre>
  
  <p>How can I fix this missing step?</p>
  
  <p><strong>UPDATE 3:</strong>
  I just found a similar issue now, but still couldn't find a solution: <a href="https://stackoverflow.com/questions/39181691/trailing-spaces-when-authenticating-to-wso2-identity-server">Trailing spaces when authenticating to WSO2 Identity Server</a></p>
  
  <p>Thank you! 
  Mat</p>