apereo/cas · warning

Passwordless account

Error message

Passwordless account [{}] does not allow delegated authentication

What it means

AcceptPasswordlessSelectionMenuAction rejects the DELEGATION menu option when isDelegatedAuthenticationActiveFor is false for the user's account/request; CAS logs this warning and returns an error event. Delegated authentication is not available for this passwordless account.

Solutions

1. Verify delegated authentication is configured (cas.authn.pac4j.*) and active for the current service
2. Check the passwordless account's allowed selection options in the account store
3. Confirm isDelegatedAuthenticationActiveFor logic/customizations for this requestContext
4. Have the user select a supported option or reload the menu

Example fix

null

if (selection == PasswordlessSelectionMenu.DELEGATION && delegatedClientsFor(service).isEmpty()) renderMenuAgain(account);

When it happens

Trigger: User selects DELEGATION in the passwordless selection menu while no delegated client is configured/authorized for that account (delegated auth not enabled for the service or the account's allowed options).

Common situations: pac4j delegation disabled or misconfigured; account store restricts the selection menu; service not authorized for delegated clients; user picks a stale option from a cached page.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Delegated authentication has failed with client
• Passwordless account
• Passwordless account
• State [ : : ] does not have a matching transition for
• Deserialization error

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4db15effa022caab. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java:51

        this.passwordlessUserAccountStore = passwordlessUserAccountStore;
    }

    @Override
    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {
        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));

        if (!user.isAllowSelectionMenu()) {
            LOGGER.error("Passwordless account [{}] is not allowed to select options", user.getUsername());
            return buildErrorEvent(requestContext);
        }

        val selection = extractSelectedAuthenticationOption(requestContext);
        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {
            LOGGER.warn("Passwordless account [{}] does not require a password", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow delegated authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {
            LOGGER.warn("Passwordless account [{}] does not allow multifactor authentication", user.getUsername());
            return buildErrorEvent(requestContext);
        }
        return buildFinalSelectionEvent(requestContext, selection);
    }

    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {
        val finalEvent = switch (selection) {
            case PASSWORD -> {
                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));
                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));
                yield CasWebflowConstants.TRANSITION_ID_PROMPT;
            }
            case TOKEN -> CasWebflowConstants.TRANSITION_ID_DISPLAY;
            case MFA -> CasWebflowConstants.TRANSITION_ID_MFA;

View on GitHub (pinned to e7288fc434)