Client IP [ ] is rejected for authentication because…

Error message

Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]

What it means

When the IP intelligence result is ranked (scored), isIpAddressRejected compares the score against cas.authn.adaptive.risk.core.threshold and rejects the request if score >= threshold. This warning tells you the numeric risk score attributed to the client IP exceeded the configured cutoff.

Solutions

Raise cas.authn.adaptive.risk.core.threshold to a value above typical benign-IP scores
Tune or replace the IP intelligence/risk provider or calibrate its scores
Exempt the offending IP range if it is a trusted shared network

Example fix

// before
cas.authn.adaptive.risk.core.threshold=30
// after
cas.authn.adaptive.risk.core.threshold=80

Defensive patterns

Strategy: validation

Validate before calling

var r = ipIntel.examine(ctx, ip); if (r != null && r.isRanked() && r.getScore() >= props.getRisk().getCore().getThreshold()) { /* pre-check before auth */ }

Type guard

boolean scoreWithinThreshold(IPIntelligenceResult r, double threshold) { return r == null || !r.isRanked() || r.getScore() < threshold; }

Prevention

Calibrate threshold against your risk provider's score distribution
Log scores in debug mode when tuning
Re-evaluate thresholds after provider changes

When it happens

Trigger: ipResult.isRanked() is true and ipResult.getScore() >= adaptiveAuthenticationProperties.getRisk().getCore().getThreshold() while examining the client IP.

Common situations: Threshold set too low for the risk provider's score scale; shared IP (university/office NAT) with moderate score; noisy third-party risk feed assigning high scores.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/060e9f2f98338a70. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java:91

    }

    private boolean isUserAgentRejected(final String userAgent) {
        val rejectBrowsers = this.adaptiveAuthenticationProperties.getPolicy().getRejectBrowsers();
        return StringUtils.isNotBlank(rejectBrowsers)
               && RegexUtils.find(rejectBrowsers, userAgent);
    }

    private boolean isIpAddressRejected(final RequestContext requestContext, final String clientIp) throws Throwable {
        LOGGER.trace("Located client IP address as [{}]", clientIp);
        val ipResult = ipAddressIntelligenceService.examine(requestContext, clientIp);
        if (ipResult == null || ipResult.isBanned()) {
            LOGGER.warn("Client IP [{}] is banned", clientIp);
            return true;
        }
        if (ipResult.isRanked()) {
            val threshold = adaptiveAuthenticationProperties.getRisk().getCore().getThreshold();
            if (ipResult.getScore() >= threshold) {
                LOGGER.warn("Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]",
                    clientIp, ipResult.getScore(), threshold);
                return true;
            }
        }
        return false;
    }
}

View on GitHub (pinned to e7288fc434)