apereo/cas · warning

Final ticket id [ ] length [ ] exceeds [ ] characters

Error message

Final ticket id [{}] length [{}] exceeds [{}] characters

What it means

TicketCompactor.validate inspects an EncodedTicket produced by ticket compression/compaction. If getMaximumTicketLength() is positive and the final (encoded) ticket id is at or above the maximum length, it warns that compaction did not shrink the id enough and returns the ticket unchanged. This flags tickets that may fail to round-trip through size-constrained transports (cookies, session stores, HTTP headers).

Solutions

1. Raise the relevant maximum ticket length setting (e.g. cas.authn.ticket.tgt.max-length or the registry's getMaximumTicketLength source configuration) to accommodate encoded ids.
2. Reduce what goes into the ticket: shorten service URLs, move large attributes out of the ticket payload.
3. Review the ticket encoder/compression settings so encoded ids actually shrink below the limit.
4. Inspect the logged ticket length vs. the maximum to size the new limit precisely; remember the check is >= getMaximumTicketLength().

Example fix

// before
cas.authn.ticket.tgt.max-length=256

// after: accommodate encoded ticket ids
cas.authn.ticket.tgt.max-length=512

if (maxTicketLength > 0 && encodedTicketId.length() >= maxTicketLength) {
    throw new IllegalArgumentException("Encoded ticket id " + encodedTicketId.length()
        + " exceeds max " + maxTicketLength);
}

When it happens

Trigger: A ticket registry/encoder produces an encoded ticket id whose length >= the configured maximum ticket length; e.g. very long service URLs or long cipher output inflating the encoded id beyond the limit.

Common situations: Oversized service parameters or long principal attributes making ticket ids huge; cipher/encoding settings producing long base64 payloads; maximumTicketLength configured too small for the deployment's ticket format.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• Ticket passed is null and cannot be decoded
• Unable to locate ticket map for ticket metadata
• Service ticket [ ] does not exist.
• Service ticket [ ] is not assigned a valid ticket granting…
• No ticket definition could be found in the catalog to match

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e92eff153ab803c3. Report an issue: GitHub.

Appendix: source

Thrown at api/cas-server-core-api-ticket/src/main/java/org/apereo/cas/ticket/registry/TicketCompactor.java:104

     * @param ticketId the ticket id
     * @return the common ticket structure
     */
    default CompactTicket parse(final String ticketId) {
        val ticketElements = List.of(StringUtils.commaDelimitedListToStringArray(ticketId));
        val creationTimeInSeconds = Instant.ofEpochSecond(Long.parseLong(ticketElements.get(CompactTicketIndexes.CREATION_TIME.getIndex())));
        val expirationTimeInSeconds = Instant.ofEpochSecond(Long.parseLong(ticketElements.get(CompactTicketIndexes.EXPIRATION_TIME.getIndex())));
        return new CompactTicket(ticketElements, creationTimeInSeconds, expirationTimeInSeconds);
    }

    /**
     * Validate.
     *
     * @param finalTicket the final ticket
     * @return the ticket
     */
    default Ticket validate(final EncodedTicket finalTicket) {
        if (getMaximumTicketLength() > 0 && finalTicket.getId().length() >= getMaximumTicketLength()) {
            LOGGER.warn("Final ticket id [{}] length [{}] exceeds [{}] characters",
                finalTicket.getId(), finalTicket.getId().length(), getMaximumTicketLength());
        }
        return finalTicket;
    }

    @RequiredArgsConstructor
    @Getter
    enum CompactTicketIndexes {
        /**
         * Represents the creation time of a compact ticket.
         * The value of this variable is an integer that represents a specific time
         * using a timestamp format.
         */
        CREATION_TIME(0),
        /**
         * Represents the expiration time of a compact ticket.
         * The value of this variable is an integer that represents a specific time
         * using a timestamp format.

View on GitHub (pinned to e7288fc434)