apereo/cas · error · CredentialsException

Could not authenticate the provided credentials

Error message

Could not authenticate the provided credentials

What it means

Thrown when CAS internal authentication (finalizeAuthenticationTransaction) returns null for the username/password credentials, meaning the authentication transaction could not produce an AuthenticationResult. Unlike a normal failed login (which is wrapped by the catch block), this signals the authentication pipeline itself yielded no result.

Solutions

1. Verify the username/password directly against the underlying authentication store (LDAP/AD/JDBC) outside CAS
2. Check that an authentication handler is configured and applicable to this service (handler selection/attribute-based criteria)
3. Inspect CAS logs at DEBUG for the authentication transaction to see why no handler produced a result
4. If handlers are conditionally enabled, confirm the feature/config that registers the needed handler is active

Example fix

null

if (!username || !password) throw new Error('username and password must be non-empty before authentication');

try {
  await casAuthenticate(creds);
} catch (e) {
  if (String(e.message) === 'Could not authenticate the provided credentials') {
    // surface a user-facing 'invalid username or password' and check handler config
  }
}

When it happens

Trigger: The authenticationSystemSupport could not finalize the transaction for the given service and UsernamePasswordCredential — typically because no authentication handler accepted the credentials or the handler chain produced no authentication for the target service.

Common situations: User typed wrong credentials and no fallback handler exists; authentication handler for the relevant store not enabled/registered for this service; service policy excludes all applicable handlers; misconfigured authentication system at startup.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Password is null.
• Client Credentials provided is not valid for registered…
• Cannot login user using CAS internal authentication
• access_denied
• Authentication handler is disabled

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/355e51059e94f651. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java:95

            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);

            val clientSecret = clientIdAndSecret.getRight();
            if (!clientSecretValidator.validate(registeredService, clientSecret)) {
                throw new CredentialsException("Client Credentials provided is not valid for registered service: "
                    + Objects.requireNonNull(registeredService).getName());
            }
            val redirectUri = requestParameterResolver.resolveRequestParameter(callContext.webContext(), OAuth20Constants.REDIRECT_URI)
                .map(String::valueOf).orElse(StringUtils.EMPTY);
            OAuth20Utils.validateRedirectUri(redirectUri, true);
            val service = StringUtils.isNotBlank(redirectUri)
                ? webApplicationServiceFactory.createService(redirectUri)
                : webApplicationServiceFactory.createService(clientId);
            service.getAttributes().put(OAuth20Constants.CLIENT_ID, CollectionUtils.wrapList(clientId));
            service.getAttributes().put(OAuth20Constants.REDIRECT_URI, CollectionUtils.wrapList(redirectUri));

            val authenticationResult = authenticationSystemSupport.finalizeAuthenticationTransaction(service, casCredential);
            if (authenticationResult == null) {
                throw new CredentialsException("Could not authenticate the provided credentials");
            }

            val principal = buildAuthenticatedPrincipal(authenticationResult, registeredService, service, callContext);
            val profile = new CommonProfile();

            profile.setId(principal.getId());
            profile.addAttribute(OAuth20Constants.CLIENT_ID, clientId);
            profile.addAttributes((Map) principal.getAttributes());

            val authentication = authenticationResult.getAuthentication();
            val authnAttributes = authenticationAttributeReleasePolicy.getAuthenticationAttributesForRelease(authentication, registeredService);
            profile.addAuthenticationAttributes(new HashMap<>(authnAttributes));

            LOGGER.debug("Authenticated user profile [{}]", profile);
            credentials.setUserProfile(profile);
            return Optional.of(credentials);
        } catch (final Throwable e) {
            throw new CredentialsException("Cannot login user using CAS internal authentication", e);

View on GitHub (pinned to e7288fc434)