apereo/cas · error · InvalidResourceSetException

Authentication request does contain a client id

Error message

Authentication request does contain a client id

What it means

A UMA resource set must carry the client id of the registering OAuth service. When ResourceSet.validate(profile) finds a blank clientId it throws InvalidResourceSetException with HTTP 400, rejecting the resource-set registration request.

Solutions

1. Include the registered service's clientId in the resource-set registration JSON body
2. Check the JSON property name is exactly 'clientId' as bound by the ResourceSet model
3. Confirm the OAuth service itself is registered in CAS and its id/clientId is used verbatim
4. Validate the payload client-side before POSTing

Example fix

// before
{"name":"photos","scopes":["read"]}
// after
{"name":"photos","clientId":"myClient","scopes":["read"]}

if (resourceSet.getClientId() == null || resourceSet.getClientId().isBlank()) {
  throw new IllegalArgumentException("clientId is required for UMA resource set registration");
}

boolean hasClientId(ResourceSet rs) { return rs.getClientId() != null && !rs.getClientId().isBlank(); }

try { registerResourceSet(rs); } catch (InvalidResourceSetException e) { return ResponseEntity.badRequest().body(e.getMessage()); }

When it happens

Trigger: Registering a UMA resource set (POST to the resource_set registration endpoint) with a JSON body lacking the clientId field, or with clientId empty/whitespace, calling ResourceSet.validate.

Common situations: Client forgot to include clientId in the resource-set registration payload; JSON field name mismatch (client_id vs clientId) so it deserializes to null; registering via a tool that builds the body from an incomplete template.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Resource set registration is missing scopes
• Resource-set owner does not match the authenticated profile
• Cannot update a resource set without identifiers.
• Cannot update a resource set with inconsistent/mismatched…
• Resource ID already exists in namespace .

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/3e20daab5404f561. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/ticket/resource/ResourceSet.java:72

    @Column
    private String owner;

    @Column
    private String clientId;
    
    @Column(columnDefinition = "json")
    @Type(JsonType.class)
    private Set<ResourceSetPolicy> policies = new HashSet<>();

    /**
     * Validate.
     *
     * @param profile the profile
     */
    @JsonIgnore
    public void validate(final UserProfile profile) {
        if (StringUtils.isBlank(getClientId())) {
            throw new InvalidResourceSetException(HttpStatus.BAD_REQUEST.value(), "Authentication request does contain a client id");
        }

        if (getScopes().isEmpty()) {
            throw new InvalidResourceSetException(HttpStatus.BAD_REQUEST.value(), "Resource set registration is missing scopes");
        }

        if (!getOwner().equals(profile.getId())) {
            throw new InvalidResourceSetException(HttpStatus.FORBIDDEN.value(), "Resource-set owner does not match the authenticated profile");
        }
    }
}

View on GitHub (pinned to e7288fc434)