apereo/cas · error · AuthenticationException

Authentication pre-processor has failed to process…

Error message

Authentication pre-processor has failed to process transaction

What it means

DefaultAuthenticationManager.authenticate throws AuthenticationException when any registered AuthenticationPreProcessor returns false from processAuthenticationTransaction, meaning a pre-processor vetoed the transaction before any handler ran.

Solutions

1. Check CAS logs for the preceding warning to identify which pre-processor failed
2. Review/disable the offending AuthenticationPreProcessor bean or its backing service
3. Fix the root cause inside the custom pre-processor (connection, cache, configuration) so it returns true
4. Remove the pre-processor registration if it is not needed for your deployment

Example fix

// before
public boolean processAuthenticationTransaction(AuthenticationTransaction t) { return riskService.check(t); } // service down -> false
// after
public boolean processAuthenticationTransaction(AuthenticationTransaction t) {
    try { return riskService.check(t); } catch (Exception e) { LOGGER.warn("Risk check unavailable; allowing", e); return true; }
}

// check pre-processors before authenticate
boolean allHealthy = authenticationPreProcessors.stream()
    .allMatch(p -> p.isHealthy != null ? p.isHealthy() : true);

try {
    Authentication auth = authenticationManager.authenticate(transaction);
} catch (AuthenticationException e) {
    if (e.getMessage().contains("pre-processor has failed")) {
        LOGGER.error("Identify failing AuthenticationPreProcessor from preceding WARN log");
    }
}

When it happens

Trigger: A custom or built-in AuthenticationPreProcessor (e.g. credential caching, risk-aware or MFA pre-processing) evaluates the transaction and returns false; authenticate() then aborts with this message and logs a warning naming pre-processor failure.

Common situations: Custom pre-processor plugins misbehaving (e.g. failure to reach a risk service, corrupted cache) returning false; ordering issues where a pre-processor runs before required state exists; configuration enabling a pre-processor whose backing service is down.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication handler is disabled
• No user can be accepted because none is defined
• not found in backing map.
• Unable to authenticate
• No authentication handlers could be resolved to support the…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/5cf570b8070ec53a. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java:64

    private final AuthenticationEventExecutionPlan authenticationEventExecutionPlan;

    private final ObjectProvider<AuthenticationSystemSupport> authenticationSystemSupport;

    private final boolean principalResolutionFailureFatal;

    private final ConfigurableApplicationContext applicationContext;

    @Override
    @Audit(
        action = AuditableActions.AUTHENTICATION,
        actionResolverName = AuditActionResolvers.AUTHENTICATION_RESOLVER,
        resourceResolverName = AuditResourceResolvers.AUTHENTICATION_RESOURCE_RESOLVER)
    public Authentication authenticate(final AuthenticationTransaction transaction) throws Throwable {
        val result = invokeAuthenticationPreProcessors(transaction);
        if (!result) {
            LOGGER.warn("An authentication pre-processor could not successfully process the authentication transaction");
            throw new AuthenticationException("Authentication pre-processor has failed to process transaction");
        }
        val authenticationBuilder = authenticateInternal(transaction);
        val authentication = authenticationBuilder.build();
        addAuthenticationMethodAttribute(authenticationBuilder, authentication);
        populateAuthenticationMetadataAttributes(authenticationBuilder, transaction);
        invokeAuthenticationPostProcessors(authenticationBuilder, transaction);

        val auth = authenticationBuilder.build();
        val principal = auth.getPrincipal();
        if (principal instanceof NullPrincipal) {
            throw new UnresolvedPrincipalException(auth);
        }
        LOGGER.info("Authenticated principal [{}] with attributes [{}] via credentials [{}].",
            principal.getId(), principal.getAttributes(), transaction.getCredentials());
        return auth;
    }

    protected void invokeAuthenticationPostProcessors(final AuthenticationBuilder builder,

View on GitHub (pinned to e7288fc434)