apereo/cas · warning

Service access for [ ] is denied

Error message

Service access for [{}] is denied

What it means

BaseDelegatedClientIdentityProviderAuthorizer.handleAuthorizationForService warns and returns false when the service matched by ServicesManager either is not found or its access strategy disallows access for the requested service URL during delegated authentication authorization. The delegated authentication attempt for that service is then refused.

Solutions

1. Register the service in the CAS services registry (or fix the serviceId/pattern so it matches) so findServiceBy locates it.
2. Fix the registered service's access strategy (set enabled=true, correct allowed attributes/URLs) so isServiceAccessAllowed returns true.
3. Verify the request's service URL matches the intended registered service definition.

Example fix

// before: service JSON
{ "@class": "...RegexRegisteredService", "serviceId": "^https://old\.example\.com/.*", "id": 1 }
// after
{ "@class": "...RegexRegisteredService", "serviceId": "^https://app\.example\.com/.*", "id": 1 }

RegisteredService svc = servicesManager.findServiceBy(service);
boolean allowed = svc != null && svc.getAccessStrategy().isServiceAccessAllowed(svc, service);
if (!allowed) { /* do not start delegated auth for this service */ }

When it happens

Trigger: isDelegatedClientAuthorizedFor invokes handleAuthorizationForService with a service URL; servicesManager.findServiceBy(service) returns null (unregistered service) or registeredService.getAccessStrategy().isServiceAccessAllowed(...) returns false (e.g. service excluded, unauthorized pattern, or access strategy disabled).

Common situations: Service not registered or URL pattern mismatch so findServiceBy returns null; registered service access strategy (allowedAttributes/authorizedToProxy/etc., enabled=false) denies the request; service recently disabled while users still access it.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Delegated authentication has failed with client
• Client name for [ ] is set to a generated value of [ ]…
• Authentication cannot find attribute
• No custom principal attribute was provided by the client
• CAS cannot use [ ] as the principal attribute id, since the…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e07af7a8ad358ff6. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java:64

                                                  final HttpServletRequest request) throws Throwable {
        val tenantDefinition = tenantExtractor.extract(request);
        return (tenantDefinition.isEmpty() || isDelegatedClientAuthorizedForTenant(clientName, tenantDefinition.get()))
            && handleAuthorizationForService(clientName, service);
    }

    protected boolean handleAuthorizationForService(final String clientName, final Service service) throws Throwable {
        if (service == null || StringUtils.isBlank(service.getId())) {
            LOGGER.trace("Can not evaluate delegated authentication policy without a service");
            return true;
        }
        if (StringUtils.isBlank(clientName)) {
            LOGGER.trace("No identity provider is provided to enforce authorization for delegated authentication. SSO session "
                + "may have been established without delegated authentication");
            return true;
        }
        val registeredService = servicesManager.findServiceBy(service);
        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {
            LOGGER.warn("Service access for [{}] is denied", registeredService);
            return false;
        }
        LOGGER.trace("Located registered service definition [{}] matching [{}]", registeredService, service);
        val auditContext = AuditableContext.builder()
            .registeredService(registeredService)
            .service(service)
            .properties(CollectionUtils.wrap(Client.class.getSimpleName(), clientName))
            .build();
        val result = delegatedAuthenticationPolicyEnforcer.execute(auditContext);
        if (!result.isExecutionFailure()) {
            LOGGER.debug("Delegated authentication policy for [{}] allows for using provider [{}]", registeredService, clientName);
            return true;
        }
        LOGGER.warn("Delegated authentication policy for [{}] refuses access to provider [{}]", registeredService.getServiceId(), clientName);
        return false;
    }

    protected boolean isDelegatedClientAuthorizedForTenant(final String clientName, final TenantDefinition tenantDefinition) {

View on GitHub (pinned to e7288fc434)