apereo/cas · error · UnauthorizedServiceException

Service [ ] is not found in service registry.

Error message

Service [%s] is not found in service registry.

What it means

During /serviceValidate (or /p3/serviceValidate) the requested service could not be matched to any registered service in the CAS service registry, so verifyRegisteredServiceProperties throws UnauthorizedServiceException.denied. CAS refuses to validate tickets for unregistered services.

Solutions

1. Register the exact service URL (or a matching pattern) in the CAS service registry via the management console or JSON registry file, then ensure the registry is loaded.
2. Verify the service parameter sent by the client matches the registry entry character-for-character (scheme, host, port, path) or adjust the pattern to a regex that covers it.
3. If the registry entry exists, check the registry cache/replication and call the services management endpoints or restart to force a reload.

Example fix

// JSON service registry: before (entry missing)
// after: create /etc/cas/services/myApp-10000001.json
{
  "@class": "org.apereo.cas.services.RegisteredService",
  "serviceId": "^https://myapp\.example\.org/.*",
  "id": 10000001,
  "name": "MyApp",
  "evaluationOrder": 1
}

// client side, before calling /serviceValidate
// ensure the service is registered and matches a registry pattern exactly
const registered = ["^https:\/\/myapp\.example\.org\/.*"];
if (!registered.some(p => new RegExp(p).test(serviceUrl))) {
  throw new Error(`Service ${serviceUrl} is not registered in CAS`);
}

try {
    // validate ticket against CAS
} catch (UnauthorizedServiceException e) {
    // registry lookup failed: check service registry entry and URL match
}

When it happens

Trigger: getServiceCredentialsFromRequest extracts the service from the request, looks it up via ServicesManager, and passes the result to verifyRegisteredServiceProperties; the null branch fires when no registered service matches the passed service id/url (or registry lookup returns nothing).

Common situations: Client app URL not registered in the CAS service registry; regex/exact-match pattern in the registry entry doesn't match the actual service parameter (trailing slash, http vs https, port); service registry changes not yet replicated (registry sync delay or cache not refreshed).

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• ServiceManagement: Unauthorized Service Access. Service
• Unauthorized
• Service is not found or is disabled in the service registry.
• Service [ ] is not found in service registry.
• Service Management: Unauthorized Service Access. Service

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/5dfa02e985a4dd3d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-validation-core/src/main/java/org/apereo/cas/web/AbstractServiceValidateController.java:64

 * validation services. Receive back an Assertion containing the user Principal
 * and (possibly) a chain of Proxy Principals. Store the Assertion in the Model
 * and chain to a View to generate the appropriate response (CAS 1, CAS 2 XML,
 * SAML, ...).
 *
 * @author Scott Battaglia
 * @author Misagh Moayyed
 * @since 3.0.0
 */
@Slf4j
@Getter
@RequiredArgsConstructor(access = AccessLevel.PROTECTED)
public abstract class AbstractServiceValidateController extends AbstractDelegateController {
    private final ServiceValidateConfigurationContext serviceValidateConfigurationContext;

    private static void verifyRegisteredServiceProperties(final RegisteredService registeredService, final Service service) {
        if (registeredService == null) {
            val msg = String.format("Service [%s] is not found in service registry.", service.getId());
            LOGGER.warn(msg);
            throw UnauthorizedServiceException.denied(msg);
        }
        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {
            val msg = String.format("ServiceManagement: Unauthorized Service Access. "
                + "Service [%s] is not enabled in the CAS service registry.", service.getId());
            LOGGER.warn(msg);
            throw UnauthorizedServiceException.denied(msg);
        }
    }

    protected Ticket handleProxyGrantingTicketDelivery(final String serviceTicketId, final Credential credential) throws Throwable {
        val serviceTicket = serviceValidateConfigurationContext.getTicketRegistry().getTicket(serviceTicketId, ServiceTicket.class);
        val authenticationResult = serviceValidateConfigurationContext.getAuthenticationSystemSupport()
            .finalizeAuthenticationTransaction(serviceTicket.getService(), credential);
        val proxyGrantingTicket = serviceValidateConfigurationContext.getCentralAuthenticationService()
            .createProxyGrantingTicket(serviceTicketId, authenticationResult);
        LOGGER.debug("Generated proxy-granting ticket [{}] off of service ticket [{}] and credential [{}]",
            proxyGrantingTicket.getId(), serviceTicketId, credential);

View on GitHub (pinned to e7288fc434)