apereo/cas · error · GeneralSecurityException

<script exception>

Error message

<script exception>

What it means

The Groovy authentication-policy script itself signaled failure by returning an Optional<Exception> whose value is present; the policy rethrows that script-produced exception as a GeneralSecurityException so the policy is unsatisfied. It is not a script syntax error — the script executed successfully and deliberately reported a policy violation for the current authentication attempt.

Solutions

1. Inspect the script's returned exception to learn why the policy judged the authentication unsatisfactory
2. Review the Groovy policy script logic against the authentication/context bindings
3. Adjust the script or the authentication data so the policy condition passes

When it happens

Trigger: Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java:77 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/2a25ced4c5f9d964. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java:77

        final Map<String, ? extends Serializable> context) throws Throwable {

        if (authentication == null) {
            LOGGER.warn("Authentication attempt is null and cannot satisfy policy");
            return AuthenticationPolicyExecutionResult.failure();
        }
        
        initializeWatchableScriptIfNeeded();

        val args = CollectionUtils.<String, Object>wrap(
            "authentication", authentication,
            "context", context,
            "applicationContext", applicationContext,
            "logger", LOGGER);
        Objects.requireNonNull(executableScript).setBinding(args);
        val ex = executableScript.execute(args.values().toArray(), Optional.class);
        if (ex != null && ex.isPresent()) {
            val exception = (Exception) ex.get();
            throw new GeneralSecurityException(exception);
        }
        return AuthenticationPolicyExecutionResult.success();
    }

    @Override
    public boolean shouldResumeOnFailure(final Throwable failure) {
        val supplier = Unchecked.supplier(() -> {
            initializeWatchableScriptIfNeeded();
            val args = CollectionUtils.wrap("failure", failure, "logger", LOGGER);
            Objects.requireNonNull(executableScript).setBinding(args);
            return Boolean.TRUE.equals(executableScript.execute("shouldResumeOnFailure",
                Boolean.class, args.values().toArray()));
        });
        val result = supplier.get();
        Assert.notNull(result, "Authentication policy result cannot be null");
        return result;
    }

View on GitHub (pinned to e7288fc434)