apereo/cas · error · InvalidCibaRequestException

Registered OpenID Connect relying party does not support…

Error message

Registered OpenID Connect relying party does not support backchannel authentication requests

What it means

AccessTokenCibaGrantRequestExtractor.extractRequest throws InvalidCibaRequestException with this message when the client polls the CIBA token endpoint but its registered OIDC service is not set up for backchannel authentication: it lacks the ciba grant type, a backchannel client notification endpoint, or a backchannel token delivery mode. CAS rejects the request before doing any token work.

Solutions

Add the CIBA grant type to the service's supported grant types
Set backchannelClientNotificationEndpoint and backchannelTokenDeliveryMode (poll or ping) on the registered service
Confirm the client is actually meant to use CIBA; otherwise fix the client to use its registered grant type

Example fix

// before (service definition)
"supportedGrantTypes": ["authorization_code"],
"backchannelTokenDeliveryMode": null
// after
"supportedGrantTypes": ["authorization_code","urn:openid:params:grant-type:ciba"],
"backchannelTokenDeliveryMode": "poll",
"backchannelClientNotificationEndpoint": "https://client.example.org/ciba"

Defensive patterns

Strategy: validation

Validate before calling

var cibaReady = service.getSupportedGrantTypes().contains("urn:openid:params:grant-type:ciba")
    && StringUtils.isNotBlank(service.getBackchannelClientNotificationEndpoint())
    && StringUtils.isNotBlank(service.getBackchannelTokenDeliveryMode());
if (!cibaReady) throw new IllegalStateException("Client " + service.getClientId() + " is not CIBA-capable");

Try / catch

try { return extractor.extractRequest(context); } catch (InvalidCibaRequestException e) { if (e.getMessage().contains("does not support backchannel")) { throw new UnauthorizedClientException(e.getMessage()); } throw e; }

Prevention

Register CIBA grant type plus notification endpoint and delivery mode on any client that will use CIBA
Reconcile client capabilities with the CAS service registry before enabling CIBA in the client SDK
Test CIBA flows in staging with the exact registered service definition

When it happens

Trigger: A CIBA token request (grant_type=urn:openid:params:grant-type:ciba) arrives for a registeredService where supportedGrantTypes omits CIBA, or backchannelClientNotificationEndpoint is blank, or backchannelTokenDeliveryMode is blank.

Common situations: Client registered for authorization_code only tries to use CIBA; admin created the service but never filled the backchannel settings (notification endpoint, delivery mode); service definition cloned without CIBA fields.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/abb35aa9884b7193. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/ciba/AccessTokenCibaGrantRequestExtractor.java:68

        val service = configurationContext.getAuthenticationBuilder()
            .buildService(registeredService, context, true);

        val cibaFactory = (OidcCibaRequestFactory) configurationContext.getTicketFactory().get(OidcCibaRequest.class);
        val decodedId = cibaFactory.decodeId(authRequestId);
        val cibaRequest = configurationContext.getTicketRegistry().getTicket(decodedId, OidcCibaRequest.class);

        val audit = AuditableContext.builder()
            .service(service)
            .registeredService(registeredService)
            .authentication(cibaRequest.getAuthentication())
            .build();
        val accessResult = configurationContext.getRegisteredServiceAccessStrategyEnforcer().execute(audit);
        accessResult.throwExceptionIfNeeded();

        if (!registeredService.getSupportedGrantTypes().contains(getGrantType().getType())
            || StringUtils.isBlank(registeredService.getBackchannelClientNotificationEndpoint())
            || StringUtils.isBlank(registeredService.getBackchannelTokenDeliveryMode())) {
            throw new InvalidCibaRequestException("Registered OpenID Connect relying party does not support backchannel authentication requests");
        }
        val deliveryMode = OidcBackchannelTokenDeliveryModes.valueOf(registeredService.getBackchannelTokenDeliveryMode().toUpperCase(Locale.ENGLISH));
        if (deliveryMode != OidcBackchannelTokenDeliveryModes.POLL && deliveryMode != OidcBackchannelTokenDeliveryModes.PING) {
            throw new InvalidCibaRequestException("Backchannel token delivery mode cannot grant access tokens");
        }
        if (!cibaRequest.isReady()) {
            throw new InvalidCibaRequestException("CIBA request %s is not ready to grant access tokens".formatted(authRequestId));
        }
        
        return AccessTokenRequestContext.builder()
            .service(service)
            .authentication(cibaRequest.getAuthentication())
            .registeredService(registeredService)
            .responseType(getResponseType())
            .grantType(getGrantType())
            .scopes(cibaRequest.getScopes())
            .userProfile(profile)
            .clientId(registeredService.getClientId())

View on GitHub (pinned to e7288fc434)