apereo/cas · error · GeneralSecurityException

Aborting since DenyRevocationPolicy is in effect.

Error message

Aborting since DenyRevocationPolicy is in effect.

What it means

DenyRevocationPolicy is a RevocationPolicy whose apply(Void) unconditionally throws GeneralSecurityException — it deliberately denies every revocation decision so administrators can configure a hard block with a deterministic, descriptive failure.

Solutions

Configure a real policy (e.g. ThwartRevocationPolicy, AllowRevocationPolicy, or OnlyCertainRevocationPolicy) matching your revocation requirements.
If the hard deny is intentional, catch GeneralSecurityException at the authentication boundary and map it to an 'authentication failed' outcome.
Review which RevocationPolicy bean is actually wired into the X.509 configuration.
Add an integration test with a valid certificate to confirm the chosen policy allows the expected flow.

Example fix

// before
@Bean
public RevocationPolicy revocationPolicy() { return new DenyRevocationPolicy(); }
// after
@Bean
public RevocationPolicy revocationPolicy() { return new ThwartRevocationPolicy(); }

Defensive patterns

Strategy: try-catch

Validate before calling

if (revocationPolicy instanceof DenyRevocationPolicy) { /* every apply() will throw: confirm this is intended */ }

Try / catch

try {
    revocationPolicy.apply(null);
} catch (GeneralSecurityException e) {
    // DenyRevocationPolicy: map to a normal authentication failure
}

Prevention

Audit the configured RevocationPolicy bean at deploy time.
Replace DenyRevocationPolicy with a policy matching your requirements.
Add an integration test proving valid certs authenticate.
Document the intended revocation behavior per environment.

When it happens

Trigger: apply() is invoked on a policy wired as DenyRevocationPolicy, i.e. any certificate revocation check performed while this policy is configured aborts immediately.

Common situations: cas.authn.x509 revocation policy left at a deny default while the deployment expects certificates to authenticate; copied security-hardened configs; unit tests of policy plumbing hitting the always-throwing apply().

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/98469b3f5346f5f9. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/policy/DenyRevocationPolicy.java:23

/**
 * Implements a deny policy by throwing an exception.
 *
 * @author Marvin S. Addison
 * @since 3.4.6
 */
public class DenyRevocationPolicy implements RevocationPolicy<Void> {

    /**
     * Policy application throws GeneralSecurityException to stop execution of
     * whatever process invoked application of this policy.
     *
     * @param nothing SHOULD be null; ignored in all cases.
     * @throws GeneralSecurityException Thrown in all cases.
     */
    @Override
    public void apply(final Void nothing) throws GeneralSecurityException {
        throw new GeneralSecurityException("Aborting since DenyRevocationPolicy is in effect.");
    }
}

View on GitHub (pinned to e7288fc434)