What causes "Client IP [{}] is rejected for authentication" in apereo/cas?

Remove or correct the client's IP in cas.authn.adaptive.policy.reject-ip-addresses.

Client IP [ ] is rejected for authentication

Error message

Client IP [{}] is rejected for authentication

What it means

DefaultAdaptiveAuthenticationPolicy rejects the authentication request (returns false) when the client's IP address is on the rejected-IP list configured under cas.authn.adaptive.policy.reject-ip-addresses. The warning records the offending IP.

Solutions

Remove or correct the client's IP in cas.authn.adaptive.policy.reject-ip-addresses.
Verify the forwarded-headers/proxy setup so the true client IP (not the proxy IP) is evaluated.
Check CIDR notation in the reject list for over-broad ranges (e.g. 10.0.0.0/8).
If dynamic, consider an allowlist or updated risk-based configuration instead of static IP rejection.

Example fix

// before
cas.authn.adaptive.policy.reject-ip-addresses=10.0.0.0/8
// after: narrow to the offending host
cas.authn.adaptive.policy.reject-ip-addresses=10.1.2.3

Defensive patterns

Strategy: validation

Validate before calling

val rejected = adaptiveProps.getPolicy().getRejectIpAddresses();
val clientIp = ClientInfoHolder.getClientInfo().getClientIpAddress();
if (IPAddressMatcher.matchesAny(rejected, clientIp)) {
    LOGGER.warn("Client {} will be rejected by adaptive policy", clientIp);
}

Prevention

Audit reject-ip-addresses CIDR ranges for over-broad matches.
Confirm X-Forwarded-For handling so real client IPs, not proxy IPs, are evaluated.
Document the de-listing procedure for shared NAT egress IPs.

When it happens

Trigger: isIpAddressRejected(requestContext, clientIp) matches the resolved client IP against the configured rejected IP ranges; triggered after client info and user-agent are present.

Common situations: Legitimate users behind shared NAT/proxies whose egress IP was blacklisted; IPs captured from a proxy misconfiguration (server IP forwarded instead of client IP); CIDR misconfiguration accidentally matching wide ranges.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/2500808e08fa62e6. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java:43

public class DefaultAdaptiveAuthenticationPolicy implements AdaptiveAuthenticationPolicy {

    private final GeoLocationService geoLocationService;

    private final IPAddressIntelligenceService ipAddressIntelligenceService;

    private final AdaptiveAuthenticationProperties adaptiveAuthenticationProperties;

    @Override
    public boolean isAuthenticationRequestAllowed(final RequestContext requestContext, final String userAgent,
                                                  final GeoLocationRequest location) throws Throwable {
        val clientInfo = ClientInfoHolder.getClientInfo();
        if (clientInfo == null || StringUtils.isBlank(userAgent)) {
            LOGGER.warn("No client IP or user-agent was provided. Skipping adaptive authentication policy...");
            return true;
        }
        val clientIp = clientInfo.getClientIpAddress();
        if (isIpAddressRejected(requestContext, clientIp)) {
            LOGGER.warn("Client IP [{}] is rejected for authentication", clientIp);
            return false;
        }

        if (isUserAgentRejected(userAgent)) {
            LOGGER.warn("User agent [{}] is rejected for authentication", userAgent);
            return false;
        }
        LOGGER.debug("User agent [{}] is authorized to proceed", userAgent);
        if (this.geoLocationService != null && location != null && StringUtils.isNotBlank(clientIp)
            && StringUtils.isNotBlank(this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries())) {
            val loc = this.geoLocationService.locate(clientIp, location);
            if (loc != null) {
                LOGGER.debug("Determined geolocation for [{}] to be [{}]", clientIp, loc);
                if (isGeoLocationCountryRejected(loc)) {
                    LOGGER.warn("Client [{}] is rejected for authentication based on country location", clientIp);
                    return false;
                }
            } else {

View on GitHub (pinned to e7288fc434)