apereo/cas · error · CredentialsException

Cannot login user using CAS internal authentication

Error message

Cannot login user using CAS internal authentication

What it means

Wrapper CredentialsException: any Throwable thrown inside the validate method (service lookup, access checks, secret validation, authentication, profile building) that is not already converted to a specific message is rethrown with this generic message and the original as the cause. It indicates CAS internal login for the OAuth flow failed.

Solutions

1. Inspect the chained cause (getCause) in logs — the real reason is always the wrapped Throwable
2. Confirm the client_id maps to an existing registered OAuth service and that its access strategy permits the user
3. Check availability/connectivity of backing authentication stores and the services registry
4. Reproduce with DEBUG logging on org.apereo.cas.support.oauth to pinpoint the failing step

Example fix

null

const svc = await servicesRegistry.find(clientId);
if (!svc) throw new Error('client_id is not a registered OAuth service');

try {
  await casLogin(creds);
} catch (e) {
  if (String(e.message) === 'Cannot login user using CAS internal authentication') {
    console.error('root cause:', e.cause ?? e);
  }
}

When it happens

Trigger: Any failure during username/password profile validation: unknown client_id in the service registry, service access denied, invalid secret, failed end-user authentication, or exceptions while building the principal/profile from the authentication result.

Common situations: Registered service not found (unregistered client_id); registered service access strategy blocks the user/service; underlying authentication store unreachable (LDAP down); NPE or policy exception in buildAuthenticatedPrincipal.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Client Credentials provided is not valid for registered…
• Could not authenticate the provided credentials
• access_denied
• Authentication handler is disabled
• No user can be accepted because none is defined

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4c1d496571f57926. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java:113

                throw new CredentialsException("Could not authenticate the provided credentials");
            }

            val principal = buildAuthenticatedPrincipal(authenticationResult, registeredService, service, callContext);
            val profile = new CommonProfile();

            profile.setId(principal.getId());
            profile.addAttribute(OAuth20Constants.CLIENT_ID, clientId);
            profile.addAttributes((Map) principal.getAttributes());

            val authentication = authenticationResult.getAuthentication();
            val authnAttributes = authenticationAttributeReleasePolicy.getAuthenticationAttributesForRelease(authentication, registeredService);
            profile.addAuthenticationAttributes(new HashMap<>(authnAttributes));

            LOGGER.debug("Authenticated user profile [{}]", profile);
            credentials.setUserProfile(profile);
            return Optional.of(credentials);
        } catch (final Throwable e) {
            throw new CredentialsException("Cannot login user using CAS internal authentication", e);
        }
    }

    protected Principal buildAuthenticatedPrincipal(final AuthenticationResult authenticationResult,
                                                    final OAuthRegisteredService registeredService,
                                                    final Service service, final CallContext callContext) throws Throwable {
        val authentication = authenticationResult.getAuthentication();
        val principal = authentication.getPrincipal();

        val usernameContext = RegisteredServiceUsernameProviderContext
            .builder()
            .registeredService(registeredService)
            .service(service)
            .principal(principal)
            .applicationContext(applicationContext)
            .build();
        val id = registeredService.getUsernameAttributeProvider().resolveUsername(usernameContext);
        LOGGER.debug("Created profile id [{}]", id);

View on GitHub (pinned to e7288fc434)