apereo/cas · warning

Configured login config for CAS under

Error message

Configured login config for CAS under [{}] will be ignored

What it means

JcifsConfig.initialize sets the jcifs/java login configuration (java.security.auth.login.config) for SPNEGO/JCIFS. If the login config is already supplied via the system property (e.g. -Djava.security.auth.login.config=...), CAS logs that the loginConf configured in CAS properties is ignored rather than overriding the JVM-level setting. The system property wins by design.

Solutions

1. Remove the CAS properties login-conf setting and rely on the system property, or vice versa - keep exactly one source.
2. Delete the -Djava.security.auth.login.config JVM flag if the CAS-managed login.conf should win.
3. Confirm which login.conf file is actually in effect by checking the INFO log line above the warning.
4. Document the chosen source of truth to prevent future duplicate configuration.

Example fix

// before
JAVA_OPTS="$JAVA_OPTS -Djava.security.auth.login.config=/etc/cas/jaas.conf"
# plus cas.authn.spnego.login-conf=/etc/cas/jaas.conf
// after
JAVA_OPTS="$JAVA_OPTS"  # let CAS properties own the login config
cas.authn.spnego.login-conf=/etc/cas/jaas.conf

if (System.getProperty("java.security.auth.login.config") != null) {
    // skip setting login-conf in CAS properties; sysprop already wins
}

When it happens

Trigger: initialize(resourceLoader, loginConf) is called while System.getProperty(jcifs.sysprop.login.conf) is already set to a non-blank value AND the CAS-side loginConf property is also non-blank.

Common situations: Container/JVM startup flags (JAVA_OPTS, JAVA_TOOL_OPTIONS, tomcat.conf) set java.security.auth.login.config while the CAS properties file also defines cas.authn.spnego[...].jcifs... login-conf; duplicate configuration after a migration; someone added the sysprop to 'fix' Kerberos earlier and forgot.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• Principal is null, the processing of the SPNEGO Token failed
• NTLM not allowed
• Cannot get connection from pool to validate SPNEGO Token
• Thread interrupted while waiting for connection to validate…
• User Agent header [ ] is empty, or no browsers are supported

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/14bcfa4b66d8f76c. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-spnego/src/main/java/org/apereo/cas/support/spnego/authentication/handler/support/JcifsConfig.java:41

    /**
     * Individual properties collected from CAS settings for each authentication attempt and object.
     * These settings are fed to the Spnego authentication object
     */
    public static class SystemSettings {

        /**
         * Initialize.
         *
         * @param resourceLoader the resource loader
         * @param loginConf      the login conf
         */
        public static void initialize(final ResourceLoader resourceLoader, final String loginConf) {
            val propValue = System.getProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF);
            if (StringUtils.isNotBlank(propValue)) {
                LOGGER.info("Found login config [{}] in system property [{}]", propValue, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);
                if (StringUtils.isNotBlank(loginConf)) {
                    LOGGER.warn("Configured login config for CAS under [{}] will be ignored", loginConf);
                }
            } else {
                val effectiveLoginConf = StringUtils.isBlank(loginConf) ? "/login.conf" : loginConf;
                LOGGER.debug("Attempting to load login config from [{}]", effectiveLoginConf);

                val res = resourceLoader.getResource(effectiveLoginConf);
                if (res.exists()) {
                    val urlPath = FunctionUtils.doUnchecked(() -> res.getURL().toExternalForm());
                    LOGGER.debug("Located login config [{}] and configured it under [{}]", urlPath, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);
                    System.setProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF, urlPath);
                } else {
                    val url = JcifsConfig.class.getResource("/jcifs/http/login.conf");
                    if (url != null) {
                        val fullUrl = url.toExternalForm();
                        LOGGER.debug("Falling back unto default login config [{}] under [{}]", fullUrl, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);
                        System.setProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF, fullUrl);
                    }
                }

View on GitHub (pinned to e7288fc434)