apereo/cas · warning · UnauthorizedServiceException

No service authentication request is available at

Error message

No service authentication request is available at [{}]. CAS is configured to disable the flow.

What it means

This WARN is logged by InitializeLoginAction when the login request carries no service parameter and CAS is configured to reject such requests (cas.sso.services.allow-missing-service-parameter=false). The action then throws UnauthorizedServiceException.required(), aborting the login flow as an unauthorized service request.

Solutions

1. Fix the client/application to always pass the service parameter when redirecting to CAS /login.
2. If bare-logins should be permitted, set cas.sso.services.allow-missing-service-parameter=true and restart CAS.
3. Verify the login URL/bookmark includes the encoded service parameter.

Example fix

// before: bare login URL
GET https://cas.example.org/cas/login
// after
GET https://cas.example.org/cas/login?service=https%3A%2F%2Fapp.example.org%2Fcallback

// before calling /login from your client
const loginUrl = new URL('https://cas.example.org/cas/login');
if (!serviceUrl) throw new Error('service parameter is required');
loginUrl.searchParams.set('service', serviceUrl);

function hasService(req: { query: Record<string, string> }): boolean {
  return typeof req.query.service === 'string' && req.query.service.length > 0;
}

try {
  return initializeLogin(requestContext);
} catch (UnauthorizedServiceException e) {
  LOGGER.warn("Login attempted without a service parameter at [{}]", requestUrl);
  return error("unauthorized-service");
}

When it happens

Trigger: A request hits /login without a 'service' (or TARGET) parameter while cas.sso.services.allow-missing-service-parameter is false; WebUtils.getService returns null in doExecuteInternal.

Common situations: Users bookmarking the bare /login URL; client applications that forget the service parameter on the login redirect; identity-provider-initiated flows that omit service; misconfiguration when the deployment expects missing-service logins to be allowed.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Could not grant service ticket
• Recaptcha response/token is missing from the request
• No username parameter is provided
• No providerId parameter given in unsolicited SSO…
• No surrogate identifier was selected or provided

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/b4a980e109fac48b. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/login/InitializeLoginAction.java:42

@RequiredArgsConstructor
public class InitializeLoginAction extends BaseCasWebflowAction {
    /**
     * The services manager with access to the registry.
     **/
    protected final ServicesManager servicesManager;

    /**
     * CAS Properties.
     */
    protected final CasConfigurationProperties casProperties;
    
    @Override
    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {
        LOGGER.trace("Initialized login sequence");
        val service = WebUtils.getService(requestContext);
        if (service == null && !casProperties.getSso().getServices().isAllowMissingServiceParameter()) {
            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);
            LOGGER.warn("No service authentication request is available at [{}]. CAS is configured to disable the flow.", request.getRequestURL());
            throw new NoSuchFlowExecutionException(requestContext.getFlowExecutionContext().getKey(), UnauthorizedServiceException.required());
        }
        return success();
    }

}

View on GitHub (pinned to e7288fc434)