apereo/cas · error

An authentication pre-processor could not successfully…

Error message

An authentication pre-processor could not successfully process the authentication transaction

What it means

DefaultAuthenticationManager.authenticate first runs all configured AuthenticationPreProcessors (via invokeAuthenticationPreProcessors). If any pre-processor reports failure, the manager logs this warning and throws AuthenticationException before any handler executes, aborting the authentication transaction. Pre-processors are expected to prepare/validate the transaction; a false result means the transaction cannot proceed.

Solutions

1. Inspect the logs immediately before this warning for the specific pre-processor that failed; enable DEBUG logging on org.apereo.cas.authentication to identify it.
2. Review and fix the failing AuthenticationPreProcessor bean or remove it from the Spring context if it is not needed.
3. Check the AuthenticationTransaction contents (credentials/principal) against the pre-processor's requirements.
4. Verify any pre-processor-dependent configuration (rate limits, risk settings, custom conditions) is correct and not permanently vetoing transactions.

Example fix

// before: custom pre-processor that vetoes everything
class BadPreProcessor implements AuthenticationPreProcessor {
    public boolean process(AuthenticationTransaction t) {
        return false; // accidental veto
    }
}

// after
class FixedPreProcessor implements AuthenticationPreProcessor {
    public boolean process(AuthenticationTransaction t) {
        return t.getCredentials() != null && !t.getCredentials().isEmpty();
    }
}

// before calling authenticationManager.authenticate
boolean ready = authenticationPreProcessors.stream()
    .allMatch(p -> p.supports(transaction) /* or dry-run check if exposed */);

try {
    Authentication auth = authenticationManager.authenticate(transaction);
} catch (AuthenticationException e) {
    if (e.getMessage().contains("pre-processor")) {
        // identify and fix/disable the vetoing AuthenticationPreProcessor
    }
}

When it happens

Trigger: A registered AuthenticationPreProcessor returns false for the given AuthenticationTransaction: e.g. transaction validation failures, captcha/rate-limiting pre-processors rejecting the request, or custom pre-processor logic signaling it could not process the transaction.

Common situations: Custom AuthenticationPreProcessor beans deployed with buggy conditions returning false; security pre-processors (IP throttling, risk detection) blocking the request; configuration changes making a pre-processor's expectations invalid (missing attributes in the transaction); multiple pre-processors where one veto silently fails authentication.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication pre-processor has failed to process…
• Authentication handler is disabled
• No user can be accepted because none is defined
• not found in backing map.
• Unable to authenticate

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/c15f327ae2c495ba. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java:63

public class DefaultAuthenticationManager implements AuthenticationManager {

    private final AuthenticationEventExecutionPlan authenticationEventExecutionPlan;

    private final ObjectProvider<AuthenticationSystemSupport> authenticationSystemSupport;

    private final boolean principalResolutionFailureFatal;

    private final ConfigurableApplicationContext applicationContext;

    @Override
    @Audit(
        action = AuditableActions.AUTHENTICATION,
        actionResolverName = AuditActionResolvers.AUTHENTICATION_RESOLVER,
        resourceResolverName = AuditResourceResolvers.AUTHENTICATION_RESOURCE_RESOLVER)
    public Authentication authenticate(final AuthenticationTransaction transaction) throws Throwable {
        val result = invokeAuthenticationPreProcessors(transaction);
        if (!result) {
            LOGGER.warn("An authentication pre-processor could not successfully process the authentication transaction");
            throw new AuthenticationException("Authentication pre-processor has failed to process transaction");
        }
        val authenticationBuilder = authenticateInternal(transaction);
        val authentication = authenticationBuilder.build();
        addAuthenticationMethodAttribute(authenticationBuilder, authentication);
        populateAuthenticationMetadataAttributes(authenticationBuilder, transaction);
        invokeAuthenticationPostProcessors(authenticationBuilder, transaction);

        val auth = authenticationBuilder.build();
        val principal = auth.getPrincipal();
        if (principal instanceof NullPrincipal) {
            throw new UnresolvedPrincipalException(auth);
        }
        LOGGER.info("Authenticated principal [{}] with attributes [{}] via credentials [{}].",
            principal.getId(), principal.getAttributes(), transaction.getCredentials());
        return auth;
    }

View on GitHub (pinned to e7288fc434)