apereo/cas · error · FailedLoginException

Cannot validate authentication for: [login]

Error message

Cannot validate authentication for: [login]

What it means

InweboAuthenticationHandler validates MFA credentials against the Inwebo service. If the remote service reports the push/OTP authentication as not authenticated, the handler throws FailedLoginException 'Cannot validate authentication for: <login>'. The cause is the Inwebo backend declining the transaction, not a local processing error.

Solutions

1. Have the user approve the Inwebo push request or re-enter a correct OTP and retry
2. Verify the user's device is enrolled and active in the Inwebo administration console
3. Check the Inwebo service account/user status (not locked or expired)
4. Review Inwebo service logs for the transaction result to see why authentication was denied

Example fix

// before: user retries immediately after cancelling push (still denied)
// after: trigger a new authentication so a fresh Inwebo push is sent
reauthenticate with new InweboCredential

// precheck: user is enrolled and active in Inwebo before starting authentication
boolean enrolled = inweboService.checkUserStatus(login) == UserStatus.ACTIVE;

try {
    return handler.authenticate(inweboCredential);
} catch (FailedLoginException e) {
    // prompt user to retry MFA approval / re-enter OTP
}

When it happens

Trigger: doAuthentication receives an InweboCredential for a login whose Inwebo authentication result is not 'authenticated' (denied push, wrong OTP, cancelled request, expired session).

Common situations: User declines or ignores the Inwebo push notification; user enters an incorrect OTP; device not enrolled or deactivated in the Inwebo console; Inwebo service API credentials valid but user locked/expired.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Unable to extract credentials for multifactor authentication
• Invalid credentials:
• Duo Security passcode authentication has failed
• Duo Security universal prompt authentication has failed
• Duo Security authentication has failed

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/5a2438d188a27595. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/authentication/InweboAuthenticationHandler.java:66

        val otp = inweboCredential.getOtp();
        var authenticated = inweboCredential.isAlreadyAuthenticated();
        var deviceName = inweboCredential.getDeviceName();
        if (StringUtils.isNotBlank(otp)) {
            val response = this.service.authenticateExtended(login, otp);
            if (response.isOk()) {
                authenticated = true;
                deviceName = response.getDeviceName();
            }
        }

        if (authenticated) {
            inweboCredential.setDeviceName(deviceName);
            LOGGER.info("Authenticated user: [{}] for device: [{}]", login, deviceName);
            val principal = this.principalFactory.createPrincipal(login);
            return createHandlerResult(inweboCredential, principal);
        }
        throw new FailedLoginException("Cannot validate authentication for: " + login);
    }

    @Override
    public boolean supports(final Class<? extends Credential> clazz) {
        return InweboCredential.class.isAssignableFrom(clazz);
    }

    @Override
    public boolean supports(final Credential credential) {
        return InweboCredential.class.isAssignableFrom(credential.getClass());
    }
}

View on GitHub (pinned to e7288fc434)