apereo/cas · error · IllegalArgumentException

Cannot save a resource set with inconsistent scopes.

Error message

Cannot save a resource set with inconsistent scopes.

What it means

JpaResourceSetRepository.save performs the same scope validation as the base repository before merging the ResourceSet into the 'umaResourceJpaContext' persistence unit. If the resource set's scopes are inconsistent with the registered UMA scopes, an IllegalArgumentException is thrown and nothing is persisted. This keeps JPA-backed UMA resource sets consistent with the scope registry.

Solutions

Register the resource set's scopes in the UMA/service configuration before saving.
Correct scope spellings/case to match configured scopes.
Catch IllegalArgumentException around save() and surface a 400 invalid_scope error.
Audit existing resource sets after scope configuration changes and prune unknown scopes.

Example fix

// before
set.setScopes(Set.of("http://example.org/unknown"));
jpaRepo.save(set); // throws
// after
set.setScopes(Set.of("read", "write")); // registered
jpaRepo.save(set);

Defensive patterns

Strategy: validation

Validate before calling

Set<String> registered = umaConfiguration.getRegisteredScopes();
if (!set.getScopes().stream().allMatch(registered::contains)) {
    throw new IllegalArgumentException("unregistered scope in resource set");
}

Try / catch

try { jpaRepo.save(set); } catch (IllegalArgumentException e) {
    return ResponseEntity.badRequest().body(Map.of("error", "invalid_scope"));
}

Prevention

Synchronize JPA deployments' scope config with the service registry before saving
Run a migration script pruning unregistered scopes after config changes
Validate payloads at the REST layer before repository calls

When it happens

Trigger: Saving a ResourceSet through the JPA repository whose scope list fails validateResourceSetScopes (unregistered/unknown scopes).

Common situations: JPA deployments where the service definition scopes were changed after resource sets existed; clients posting resource sets with scopes absent from cas.authn.uma configuration; typos in scope names.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/29ef77f8c07e7780. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-uma-jpa/src/main/java/org/apereo/cas/uma/ticket/resource/repository/impl/JpaResourceSetRepository.java:37

 * This is {@link JpaResourceSetRepository}.
 *
 * @author Misagh Moayyed
 * @since 6.0.0
 */
@Slf4j
@EnableTransactionManagement(proxyTargetClass = false)
@Transactional(transactionManager = "umaTransactionManager")
@ToString
public class JpaResourceSetRepository extends BaseResourceSetRepository {
    private static final String ENTITY_NAME = JpaResourceSet.class.getSimpleName();

    @PersistenceContext(unitName = "umaResourceJpaContext")
    private EntityManager entityManager;

    @Override
    public ResourceSet save(final ResourceSet set) {
        if (!validateResourceSetScopes(set)) {
            throw new IllegalArgumentException("Cannot save a resource set with inconsistent scopes.");
        }
        val jpaResource = new JpaResourceSet();
        FunctionUtils.doUnchecked(_ -> BeanUtils.copyProperties(jpaResource, set));
        return entityManager.merge(jpaResource);
    }

    @Override
    public Collection<? extends ResourceSet> getAll() {
        val query = String.format("SELECT r FROM %s r", ENTITY_NAME);
        return entityManager.createQuery(query, JpaResourceSet.class).getResultList();
    }

    @Override
    public Optional<ResourceSet> getById(final long id) {
        try {
            val query = String.format("SELECT r FROM %s r WHERE r.id = :id", ENTITY_NAME);
            val resourceSet = entityManager.createQuery(query, JpaResourceSet.class)
                .setParameter("id", id)

View on GitHub (pinned to e7288fc434)