apereo/cas · warning

Access Denied for user

Error message

Access Denied for user [${username}] from IP Address [${request.getRemoteAddr()}]

What it means

DefaultThrottledRequestResponseHandler responds to a throttled (rate-limited) request by sending HTTP 423 (SC_LOCKED) with an 'Access Denied for user [x] from IP Address [y]' message. It is the standard CAS authentication-throttle rejection, not a bug in your code — the client exceeded the configured failure threshold.

Solutions

1. Wait for the throttle window to expire or clear the throttle store (in-memory/map/JDBC)
2. Raise cas.authn.throttle.* thresholds/window or reduce false positives in the failure criteria
3. Exclude trusted IPs/health-check paths from throttling and ensure username extraction (usernameParameter) is correct

Example fix

// before
cas.authn.throttle.failure-threshold=3
cas.authn.throttle.failure-range-seconds=60
// after
cas.authn.throttle.failure-threshold=10
cas.authn.throttle.failure-range-seconds=60

// client-side: back off and retry after the throttle window, not immediately
long waitSeconds = throttleWindowSeconds;

// client
try { response = http.send(req); } catch (HttpResponseException e) { if (e.getStatusCode() == 423) { Thread.sleep(windowMs); retry(); } }

When it happens

Trigger: A request matches the throttled-request filter/handler (e.g., repeated failed login or password-reset attempts) and DefaultThrottledRequestResponseHandler.handle invokes response.sendError(423, msg).

Common situations: User repeatedly failing authentication triggers the throttle; shared NAT IP causing many users to trip the limit; threshold/window configured too aggressively; automated health checks hitting throttled endpoints.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Throttled submission
• Could not authenticate locked account for
• Validation attempt for principal is throttled
• Token [ ] has exceeded the maximum number of attempts [ ]
• Client [ ] is rejected for authentication based on country…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/7f78cf836da19ca3. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-throttle/src/main/java/org/apereo/cas/throttle/DefaultThrottledRequestResponseHandler.java:35

 * @author Misagh Moayyed
 * @since 6.0.0
 */
@RequiredArgsConstructor
@Slf4j
public class DefaultThrottledRequestResponseHandler implements ThrottledRequestResponseHandler {
    private final String usernameParameter;

    @Override
    public boolean handle(final HttpServletRequest request, final HttpServletResponse response) {
        return FunctionUtils.doUnchecked(() -> {
            val username = StringUtils.isNotBlank(this.usernameParameter)
                ? StringUtils.defaultIfBlank(request.getParameter(this.usernameParameter), "N/A")
                : "N/A";
            val msg = "Access Denied for user ["
                      + StringEscapeUtils.escapeHtml4(username) + "] from IP Address ["
                      + request.getRemoteAddr() + ']';
            response.sendError(HttpStatus.SC_LOCKED, msg);
            LOGGER.warn(msg);

            return false;
        });
    }
}

View on GitHub (pinned to e7288fc434)