Provided regular expression or IP/netmask

Error message

Provided regular expression or IP/netmask [{}] does not match [{}]

What it means

CAS's Spring Security IpAddressAuthorizationManager denied the request because the client's remote address matched none of the configured required IP addresses, regexes, or CIDR/netmask patterns. It is a warn-level log plus an AuthorizationDecision(granted=false), not an exception.

Solutions

Add the actual remote address (check the logged [{}] value) to the requiredIpAddresses list
If behind a proxy, configure CAS to trust X-Forwarded-For so getRemoteAddr() yields the real client IP
Normalize address family (IPv4 vs IPv6) in the whitelist to match what the servlet reports
Correct netmask/CIDR syntax of the configured pattern and redeploy

Example fix

// before
cas.webconfig.required-ip-addresses=127.0.0.1
// after (proxy/LB or LAN access)
cas.webconfig.required-ip-addresses=127.0.0.1,10.0.0.0/8,::1

Defensive patterns

Strategy: validation

Validate before calling

var allowed = properties.getRequiredIpAddresses().stream().anyMatch(p -> RegexUtils.matchesIpAddress(p, request.getRemoteAddr()));
if (!allowed) { /* request will be denied */ }

Prevention

Whitelist the LB/proxy address too, or trust X-Forwarded-For
Test patterns with both IPv4 and IPv6 forms of the client address
Log the effective remote address when diagnosing access denials

When it happens

Trigger: authorize() is invoked for a request whose getRemoteAddr() does not match any entry of properties.getRequiredIpAddresses() as evaluated by RegexUtils.matchesIpAddress (plain IP, regex, or IP/netmask).

Common situations: Admin console restricted with cas.monitor or webconfig required-ip-addresses but the operator connects through a load balancer/proxy so the remote addr is the proxy IP; IPv6 vs IPv4 formatting mismatch; netmask written with wrong syntax; whitelist missing the developer's VPN address.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/fd6fca47fba67405. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-webconfig/src/main/java/org/apereo/cas/web/security/authentication/IpAddressAuthorizationManager.java:43

@Slf4j
@RequiredArgsConstructor
public class IpAddressAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {
    private final CasConfigurationProperties casProperties;

    private final ActuatorEndpointProperties properties;

    @Override
    public @Nullable AuthorizationResult authorize(final @NonNull Supplier<? extends Authentication> authentication,
                                                   final RequestAuthorizationContext context) {
        val remoteAddr = StringUtils.defaultIfBlank(
            context.getRequest().getHeader(casProperties.getAudit().getEngine().getAlternateClientAddrHeaderName()),
            context.getRequest().getRemoteAddr());

        val granted = properties.getRequiredIpAddresses()
            .stream()
            .anyMatch(pattern -> RegexUtils.matchesIpAddress(pattern, remoteAddr));
        if (!granted) {
            LOGGER.warn("Provided regular expression or IP/netmask [{}] does not match [{}]",
                properties.getRequiredIpAddresses(), remoteAddr);
        }
        return new AuthorizationDecision(granted);
    }
}

View on GitHub (pinned to e7288fc434)