apereo/cas · warning

Requested grant type

Error message

Requested grant type [{}] is not authorized by service definition [{}]

What it means

After enforcing the registered service's access strategy, OAuth20PasswordGrantTypeTokenRequestValidator checks isGrantTypeSupportedBy(registeredService, grantType). When the service definition does not list the `password` grant type (urn:ietf:params:oauth:grant-type:password) among its authorized grant types, the validator warns and returns false, rejecting the token request.

Solutions

1. Add "urn:ietf:params:oauth:grant-type:password" to the service definition's supportedGrantTypes.
2. Reload the service registry so the updated definition is used.
3. If the password grant is deprecated for your deployment, migrate the client to authorization_code or refresh_token grants.
4. Confirm the client actually sends grant_type=password and not another type that is similarly unlisted.

Example fix

// before (service JSON)
"supportedGrantTypes": []
// after
"supportedGrantTypes": ["urn:ietf:params:oauth:grant-type:password"]

const PASSWORD_GRANT = 'urn:ietf:params:oauth:grant-type:password';
if (!service.supportedGrantTypes?.includes(PASSWORD_GRANT)) {
  throw new Error('password grant not authorized for this service definition');
}

When it happens

Trigger: A token request with grant_type=password for a registered service whose supportedGrantTypes collection is empty or does not include the password grant type.

Common situations: Service JSON entry created without `supportedGrantTypes`; CAS tightened enforcement so previously tolerated empty lists now block the password grant; admin added response types but forgot grant types.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Requested grant type
• Response type [ ] or grant type [ ] is not supported.
• No client id is provided in the request
• Requested grant type
• Response type not authorized for service

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/9a44ca2867d68b7d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20PasswordGrantTypeTokenRequestValidator.java:60

        val clientIdAndSecret = configurationContext.getRequestParameterResolver().resolveClientIdAndClientSecret(callContext);
        val clientId = StringUtils.defaultIfBlank(clientIdAndSecret.getKey(), (String) uProfile.getAttribute(OAuth20Constants.CLIENT_ID));
        if (StringUtils.isBlank(clientId)) {
            LOGGER.warn("No client id is provided in the request");
            return false;
        }
        LOGGER.debug("Received grant type [{}] with client id [{}]", grantType, clientId);
        val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(configurationContext.getServicesManager(), clientId);
        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);
        val service = configurationContext.getWebApplicationServiceServiceFactory().createService(registeredService.getServiceId());
        val audit = AuditableContext.builder()
            .service(service)
            .registeredService(registeredService)
            .build();
        val accessResult = configurationContext.getRegisteredServiceAccessStrategyEnforcer().execute(audit);
        accessResult.throwExceptionIfNeeded();

        if (!isGrantTypeSupportedBy(registeredService, grantType)) {
            LOGGER.warn("Requested grant type [{}] is not authorized by service definition [{}]",
                grantType, registeredService.getServiceId());
            return false;
        }
        return true;
    }
}

View on GitHub (pinned to e7288fc434)