apereo/cas · error · IllegalArgumentException

Cannot save a resource set with inconsistent scopes.

Error message

Cannot save a resource set with inconsistent scopes.

What it means

Thrown by BaseResourceSetRepository.save when the UMA ResourceSet's registered scope list does not correspond to scopes the repository accepts (validateResourceSetScopes fails). CAS requires that a resource set only advertise scopes it can associate with authorization policies; inconsistent scopes would break later permission-ticket issuance. The repository refuses to persist the resource set in that case.

Solutions

  1. Ensure every scope in the ResourceSet is registered in the CAS UMA/service scope configuration before saving.
  2. Fix scope name spelling and casing to match configured scopes exactly.
  3. Add the missing scopes to the service definition or UMA scope configuration if they are legitimately needed.
  4. Catch IllegalArgumentException around save() and return a 400 invalid_scope response to the client.

Example fix

// before
ResourceSet set = new ResourceSet();
set.setScopes(Set.of("read", "writ")); // typo not registered
repository.save(set); // throws
// after
ResourceSet set = new ResourceSet();
set.setScopes(Set.of("read", "write")); // matches configured scopes
repository.save(set);
Defensive patterns

Strategy: validation

Validate before calling

Set<String> registered = umaConfiguration.getRegisteredScopes();
if (!set.getScopes().stream().allMatch(registered::contains)) {
    throw new IllegalArgumentException("ResourceSet has unregistered scopes");
}

Try / catch

try { repository.save(set); } catch (IllegalArgumentException e) {
    return ResponseEntity.badRequest().body(Map.of("error", "invalid_scope"));
}

Prevention

When it happens

Trigger: Calling save(ResourceSet) with a resource set whose scopes contain values not registered/allowed by the configured scope validator (e.g. scopes missing from the UMA resource-set scope registry or service definition).

Common situations: Registering a UMA resource set via the UMA resource-set-registration endpoint with scopes the client has not declared; typos or case mismatches in scope names; after an admin removed scopes from configuration that existing clients still request.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/bb76531cfcd58eee. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/ticket/resource/repository/BaseResourceSetRepository.java:33

        return getAll().stream()
            .filter(s -> s.getOwner().equalsIgnoreCase(owner)).collect(Collectors.toSet());
    }

    @Override
    public Collection<ResourceSet> getByClient(final String clientId) {
        return getAll().stream()
            .filter(s -> s.getClientId().equalsIgnoreCase(clientId)).collect(Collectors.toSet());
    }

    @Override
    public long count() {
        return getAll().size();
    }

    @Override
    public ResourceSet save(final ResourceSet set) {
        if (!validateResourceSetScopes(set)) {
            throw new IllegalArgumentException("Cannot save a resource set with inconsistent scopes.");
        }
        return saveInternal(set);
    }

    @Override
    public ResourceSet update(final ResourceSet currentResource, final ResourceSet newResource) {
        if (currentResource.getId() <= 0 || newResource.getId() <= 0) {
            throw new IllegalArgumentException("Cannot update a resource set without identifiers.");
        }
        if (currentResource.getId() != newResource.getId()) {
            throw new IllegalArgumentException("Cannot update a resource set with inconsistent/mismatched identifiers.");
        }
        if (!validateResourceSetScopes(newResource)) {
            throw new IllegalArgumentException("Cannot save a resource set with inconsistent scopes.");
        }

        currentResource.setOwner(newResource.getOwner());
        currentResource.setClientId(newResource.getClientId());

View on GitHub (pinned to e7288fc434)