apereo/cas · error · InvalidResourceSetException

Resource-set owner does not match the authenticated profile

Error message

Resource-set owner does not match the authenticated profile

What it means

The owner recorded on the UMA resource set must equal the id of the authenticated profile performing validation. A mismatch throws InvalidResourceSetException with HTTP 403, preventing a client or user from registering/managing a resource set owned by someone else.

Solutions

1. Set the resource set's owner to the exact id of the authenticated profile (commonly the clientId for client-registered sets)
2. Confirm the token used for registration belongs to the same client/user recorded as owner
3. Check for case/whitespace differences between owner and profile id
4. Re-register the resource set under the correct authenticated identity rather than spoofing owner

Example fix

// before
{"owner":"alice","clientId":"myClient",...}  // authenticated as myClient
// after
{"owner":"myClient","clientId":"myClient",...}

if (!Objects.equals(resourceSet.getOwner(), authenticatedProfile.getId())) {
  throw new SecurityException("Owner must match authenticated profile id");
}

boolean ownerMatches(ResourceSet rs, UserProfile p) { return Objects.equals(rs.getOwner(), p.getId()); }

try { registerResourceSet(rs); } catch (InvalidResourceSetException e) { return ResponseEntity.status(403).body(e.getMessage()); }

When it happens

Trigger: Registering or validating a resource set whose 'owner' field differs from the authenticated UserProfile.getId() (typically the authenticated client id or subject), in ResourceSet.validate.

Common situations: Registering on behalf of another client while authenticated as your own; owner field set to a human username but the profile id is the OAuth client id (or vice versa); stale resource-set templates carrying an old owner; case differences between owner and profile id.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication request does contain a client id
• Resource set registration is missing scopes
• Cannot update a resource set without identifiers.
• Cannot update a resource set with inconsistent/mismatched…
• Cannot save a resource set with inconsistent scopes.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/ad86d713db1b6d14. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-uma-core/src/main/java/org/apereo/cas/uma/ticket/resource/ResourceSet.java:80

    private Set<ResourceSetPolicy> policies = new HashSet<>();

    /**
     * Validate.
     *
     * @param profile the profile
     */
    @JsonIgnore
    public void validate(final UserProfile profile) {
        if (StringUtils.isBlank(getClientId())) {
            throw new InvalidResourceSetException(HttpStatus.BAD_REQUEST.value(), "Authentication request does contain a client id");
        }

        if (getScopes().isEmpty()) {
            throw new InvalidResourceSetException(HttpStatus.BAD_REQUEST.value(), "Resource set registration is missing scopes");
        }

        if (!getOwner().equals(profile.getId())) {
            throw new InvalidResourceSetException(HttpStatus.FORBIDDEN.value(), "Resource-set owner does not match the authenticated profile");
        }
    }
}

View on GitHub (pinned to e7288fc434)