apereo/cas · error · IllegalArgumentException

Cannot update a resource set with inconsistent/mismatched…

Error message

Cannot update a resource set with inconsistent/mismatched identifiers.

What it means

Thrown by BaseResourceSetRepository.update when currentResource.getId() and newResource.getId() differ. The update operation treats the two objects as two versions of the same resource set, so mismatched ids would silently overwrite the wrong entity. CAS rejects this as an invariant violation.

Solutions

1. Ensure newResource is a copy of currentResource (same id) with only the fields you want changed.
2. Verify the client's _id matches the resource set being updated before applying changes.
3. If ids genuinely differ, delete the old resource set and save the new one instead of update().
4. Catch IllegalArgumentException and return a 404/400 mismatched-id error to the caller.

Example fix

// before
ResourceSet other = repository.getAll().get(3);
repository.update(current, other); // ids differ -> throws
// after
ResourceSet updated = repository.findResourceSetById(current.getId()).get();
updated.setName("new-name");
repository.update(current, updated);

if (current.getId() != updated.getId()) {
    throw new IllegalStateException("ResourceSet id mismatch: " + current.getId() + " vs " + updated.getId());
}

try { repository.update(current, updated); } catch (IllegalArgumentException e) {
    return ResponseEntity.status(404).body(Map.of("error", "mismatched_resource_set_id"));
}

When it happens

Trigger: Calling update(current, new) where the two ResourceSets represent different resource sets, e.g. mixing up objects from two requests or copying fields from another resource set.

Common situations: Batch-processing resource sets and pairing the wrong current/new objects; deserializing client payloads where _id was changed by the client; stale objects after a re-save assigned a new id.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• Cannot update a resource set without identifiers.
• Authentication request does contain a client id
• Resource set registration is missing scopes
• Resource-set owner does not match the authenticated profile
• Cannot save a resource set with inconsistent scopes.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/6957f3f79e8d819d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/ticket/resource/repository/BaseResourceSetRepository.java:44

    public long count() {
        return getAll().size();
    }

    @Override
    public ResourceSet save(final ResourceSet set) {
        if (!validateResourceSetScopes(set)) {
            throw new IllegalArgumentException("Cannot save a resource set with inconsistent scopes.");
        }
        return saveInternal(set);
    }

    @Override
    public ResourceSet update(final ResourceSet currentResource, final ResourceSet newResource) {
        if (currentResource.getId() <= 0 || newResource.getId() <= 0) {
            throw new IllegalArgumentException("Cannot update a resource set without identifiers.");
        }
        if (currentResource.getId() != newResource.getId()) {
            throw new IllegalArgumentException("Cannot update a resource set with inconsistent/mismatched identifiers.");
        }
        if (!validateResourceSetScopes(newResource)) {
            throw new IllegalArgumentException("Cannot save a resource set with inconsistent scopes.");
        }

        currentResource.setOwner(newResource.getOwner());
        currentResource.setClientId(newResource.getClientId());
        currentResource.setName(newResource.getName());
        currentResource.setIconUri(newResource.getIconUri());
        currentResource.setPolicies(newResource.getPolicies());
        currentResource.setScopes(newResource.getScopes());
        currentResource.setType(newResource.getType());
        currentResource.setUri(newResource.getUri());

        return saveInternal(currentResource);
    }

    /**

View on GitHub (pinned to e7288fc434)