apereo/cas · error · InvalidTicketException

No authentication found for ticket

Error message

No authentication found for ticket 

What it means

GenerateServiceTicketAction (webflow action that grants a service ticket from the TGT) fetches the Authentication for the TGT via ticketRegistrySupport. If it returns null, the TGT has no authentication record (expired/evicted/inconsistent ticket state), so it throws InvalidTicketException with AuthenticationException message "No authentication found for ticket <id>".

Solutions

1. Force the user to re-authenticate: send the flow to the login transition when this error occurs instead of continuing to ST generation
2. Check ticket registry health/replication (e.g. Redis/Hazelcast cluster consistency) and TTL settings so authn outlives the TGT
3. Clear stale TGT cookies and restart the login flow
4. Increase cas.ticket.tgt.time-to-kill-in-seconds / max-time-to-live-in-seconds if flows legitimately run long

Example fix

// before: assuming authentication always exists
val authn = ticketRegistrySupport.getAuthenticationFrom(tgtId);
val selectedService = strategies.resolveService(service);
// after
val authn = ticketRegistrySupport.getAuthenticationFrom(tgtId);
if (authn == null) {
    return error(context); // transition to login/re-authentication
}
val selectedService = strategies.resolveService(service);

Authentication authn = ticketRegistrySupport.getAuthenticationFrom(tgtId);
if (authn == null) {
    return transition to login; // TGT is expired, evicted, or inconsistent
}

boolean tgtHasAuthentication = ticketRegistrySupport.getAuthenticationFrom(tgtId) != null;

try {
    return generateServiceTicketAction.execute(context);
} catch (InvalidTicketException e) {
    // route flow to the login transition for re-authentication
    return error(context);
}

When it happens

Trigger: Flow action executed with a TGT id present in context but the authentication object is missing from the ticket registry — e.g. registry eviction/TTL cleanup removed the authn, registry replication lag, or a corrupted TGT entry.

Common situations: Distributed ticket registries (Redis/JDBC/Mongo/Hazelcast) with inconsistent or too-aggressive eviction; long-running flows outliving ticket registry timeouts; manual registry cleanup; clock/TTL misconfiguration between nodes.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Could not grant service ticket
• Service ticket [ ] does not exist.
• State [ : : ] does not have a matching transition for
• Deserialization error
• Unable to locate authentication object in the webflow…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/15c1019c08dc6839. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/GenerateServiceTicketAction.java:77

     * authenticate and verify credentials.
     * <p>
     * In subsequent authentication flows where a TGT is available and only an ST needs to be
     * created, there are no cached copies of the credential, since we do have a TGT available.
     * So we will grab the available authentication and produce the final result based on that.
     */
    @Override
    protected @Nullable Event doExecuteInternal(final RequestContext context) throws Exception {
        val service = WebUtils.getService(context);
        LOGGER.trace("Service asking for service ticket is [{}]", service);

        val ticketGrantingTicket = WebUtils.getTicketGrantingTicketId(context);
        LOGGER.debug("Ticket-granting ticket found in the context is [{}]", ticketGrantingTicket);

        try {
            val authentication = ticketRegistrySupport.getAuthenticationFrom(ticketGrantingTicket);
            if (authentication == null) {
                val authn = new AuthenticationException("No authentication found for ticket " + ticketGrantingTicket);
                throw new InvalidTicketException(authn, ticketGrantingTicket);
            }

            val selectedService = authenticationRequestServiceSelectionStrategies.resolveService(service);
            val registeredService = servicesManager.findServiceBy(selectedService);
            LOGGER.debug("Registered service asking for service ticket is [{}]", registeredService);
            WebUtils.putRegisteredService(context, registeredService);
            WebUtils.putServiceIntoFlowScope(context, service);

            if (registeredService != null) {
                val url = registeredService.getAccessStrategy().getUnauthorizedRedirectUrl();
                if (url != null) {
                    LOGGER.debug("Registered service may redirect to [{}] for unauthorized access requests", url);
                }
                WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(context, url);
            }
            if (WebUtils.getWarningCookie(context)) {
                LOGGER.debug("Warning cookie is present in the request context. Routing result to [{}] state", CasWebflowConstants.STATE_ID_WARN);
                return result(CasWebflowConstants.STATE_ID_WARN);

View on GitHub (pinned to e7288fc434)