apereo/cas · error · UnauthorizedSsoServiceException

Denied

Error message

Denied: <service>

What it means

The service in the current authentication transaction was denied SSO: ServicesManager returned no registered service for it, or the registered service's access strategy disallowed access (isServiceAccessAllowed returned false). UnauthorizedSsoServiceException is raised during supports() so the registered-service authentication policy resolver will not apply to this transaction. The input at fault is the unresolved/disallowed service.

Solutions

1. Register the service in the service registry or fix its service ID/pattern so it matches
2. Check the registered service's access strategy (enabled, ssoEnabled, expiry/casProperties) for denial reasons
3. Verify authenticationServiceSelectionPlan resolves the incoming service to the expected registered service

When it happens

Trigger: Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/RegisteredServiceAuthenticationPolicyResolver.java:63 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ca07ff9f46e4977c. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/RegisteredServiceAuthenticationPolicyResolver.java:63

        val registeredService = servicesManager.findServiceBy(service);
        val criteria = Objects.requireNonNull(registeredService).getAuthenticationPolicy().getCriteria();
        val policies = new LinkedHashSet<AuthenticationPolicy>(1);
        if (criteria != null) {
            policies.add(criteria.toAuthenticationPolicy(registeredService));
        }
        LOGGER.debug("Authentication policies for this transaction are [{}]", policies);
        return policies;
    }

    @Override
    public boolean supports(final AuthenticationTransaction transaction) throws Throwable {
        val service = authenticationServiceSelectionPlan.resolveService(transaction.getService());
        if (service != null) {
            val registeredService = servicesManager.findServiceBy(service);
            LOGGER.trace("Located registered service definition [{}] for this authentication transaction", registeredService);
            if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {
                LOGGER.warn("Service [{}] is not allowed to use SSO.", service);
                throw new UnauthorizedSsoServiceException("Denied: %s".formatted(service));
            }
            val authenticationPolicy = registeredService.getAuthenticationPolicy();
            if (authenticationPolicy != null) {
                val criteria = authenticationPolicy.getCriteria();
                return criteria != null;
            }
        }
        return false;
    }
}

View on GitHub (pinned to e7288fc434)