apereo/cas · error · IllegalArgumentException

No ticket-granting ticket could be found in the context

Error message

No ticket-granting ticket could be found in the context

What it means

getPrincipalFromRequestContext requires a TGT id in the webflow request context, but none is present — the user has no active single-sign-on session at this point in the flow. IllegalArgumentException is a guard against proceeding to ticketRegistrySupport with a blank key. The input at fault is the missing TICKET_GRANTING_TICKET_ID flow/conversation attribute.

Solutions

  1. Ensure the caller only invokes this after authentication/SSO established a TGT
  2. Check that the TGT id is stored in the request context before this call (WebUtils.putTicketGrantingTicket...)
  3. Handle unauthenticated flows by redirecting to login instead of fetching the principal
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at core/cas-server-core-web-api/src/main/java/org/apereo/cas/web/support/WebUtils.java:646 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/0a89a6b5d5a2431b. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-web-api/src/main/java/org/apereo/cas/web/support/WebUtils.java:646

     * @param builder the builder
     * @param ctx     the ctx
     */
    public static void putAuthenticationResultBuilder(final AuthenticationResultBuilder builder, final RequestContext ctx) {
        ctx.getConversationScope().put(CasWebflowConstants.ATTRIBUTE_AUTHENTICATION_RESULT_BUILDER, builder);
    }

    /**
     * Gets the authenticated principal.
     *
     * @param requestContext        the request context
     * @param ticketRegistrySupport the ticket registry support
     * @return the principal
     */
    public static Principal getPrincipalFromRequestContext(final RequestContext requestContext,
                                                           final TicketRegistrySupport ticketRegistrySupport) {
        val tgt = WebUtils.getTicketGrantingTicketId(requestContext);
        if (StringUtils.isBlank(tgt)) {
            throw new IllegalArgumentException("No ticket-granting ticket could be found in the context");
        }

        return ticketRegistrySupport.getAuthenticatedPrincipalFrom(tgt);
    }

    /**
     * Gets principal from request context.
     *
     * @param requestContext the request context
     * @return the principal from request context
     */
    public static Principal getPrincipalFromRequestContext(final RequestContext requestContext) {
        return requestContext.getFlowScope().get("principal", Principal.class);
    }

    /**
     * Gets authentication result builder.
     *

View on GitHub (pinned to e7288fc434)