apereo/cas · warning

Client IP [ ] is banned

Error message

Client IP [{}] is banned

What it means

isIpAddressRejected consults the configured ipAddressIntelligenceService; if it returns null or a result flagged isBanned(), the client IP is treated as banned and authentication is refused with this warning. It is a deliberate IP-reputation-based block, not an internal failure.

Solutions

  1. Have the client disconnect from VPN/proxy or obtain a different IP
  2. Whitelist the IP or adjust the IP intelligence service configuration so the address is no longer banned
  3. Check why the service returns null (connectivity/auth to the risk API); a null result is conservatively treated as banned
Defensive patterns

Strategy: validation

Validate before calling

IPIntelligenceResult r = ipIntel.examine(ctx, ip); if (r == null || r.isBanned()) { /* route to support / use different network */ }

Type guard

boolean isIpAllowed(IPAddressIntelligenceService svc, RequestContext ctx, String ip) { var r = svc.examine(ctx, ip); return r != null && !r.isBanned(); }

Prevention

When it happens

Trigger: ipAddressIntelligenceService.examine(requestContext, clientIp) returns null, or returns an IPIntelligenceResult whose isBanned() is true, during isAuthenticationRequestAllowed.

Common situations: Client IP on a threat-intel blacklist (botnet, proxy, Tor exit node); shared corporate/NAT IP with bad reputation; misconfigured IP intelligence service returning null for every address; risk-service outage producing null results conservatively interpreted as banned.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/742298c629defb2c. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java:85

    }

    private boolean isGeoLocationCountryRejected(final GeoLocationResponse finalLoc) {
        val rejectCountries = this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries();
        return StringUtils.isNotBlank(rejectCountries)
               && RegexUtils.find(rejectCountries, finalLoc.build());
    }

    private boolean isUserAgentRejected(final String userAgent) {
        val rejectBrowsers = this.adaptiveAuthenticationProperties.getPolicy().getRejectBrowsers();
        return StringUtils.isNotBlank(rejectBrowsers)
               && RegexUtils.find(rejectBrowsers, userAgent);
    }

    private boolean isIpAddressRejected(final RequestContext requestContext, final String clientIp) throws Throwable {
        LOGGER.trace("Located client IP address as [{}]", clientIp);
        val ipResult = ipAddressIntelligenceService.examine(requestContext, clientIp);
        if (ipResult == null || ipResult.isBanned()) {
            LOGGER.warn("Client IP [{}] is banned", clientIp);
            return true;
        }
        if (ipResult.isRanked()) {
            val threshold = adaptiveAuthenticationProperties.getRisk().getCore().getThreshold();
            if (ipResult.getScore() >= threshold) {
                LOGGER.warn("Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]",
                    clientIp, ipResult.getScore(), threshold);
                return true;
            }
        }
        return false;
    }
}

View on GitHub (pinned to e7288fc434)