apereo/cas · error · UnauthorizedServiceException

Service is not found or is disabled in the service registry.

Error message

Service %s is not found or is disabled in the service registry.

What it means

RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed validates that a service is registered and its access strategy permits access. If the RegisteredService is null (no definition found for the service) UnauthorizedServiceException.denied is thrown with a message that the service is not found or disabled. This is the guard used before granting access/issuing tickets.

Solutions

1. Register the service (JSON/YAML/etc.) so ServicesManager can resolve it, with a serviceId pattern matching the requested URL
2. Verify ServicesManager loaded the service (logs or /services admin UI); reload the registry if hot-reload is not enabled
3. Fix the serviceId regex to match the actual URL including scheme and trailing path
4. Confirm the correct service registry storage is configured and reachable

Example fix

// before: registry lookup returns null
// RegisteredService rs = servicesManager.findServiceBy(service); // null
// after: register matching definition first
// {"@class":"org.apereo.cas.services.RegexRegisteredService","serviceId":"^https://app.example.org/cb","id":100,"accessStrategy":{"@class":"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy","enabled":true,"ssoEnabled":true}}

RegisteredService rs = servicesManager.findServiceBy(service).orElse(null);
if (rs == null || !rs.getAccessStrategy().isServiceAccessAllowed(rs, service)) {
    // deny early with a clear message to the application owner
}

try {
    RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);
} catch (UnauthorizedServiceException e) {
    LOGGER.warn("Service access denied: {}", e.getMessage());
    throw e; // or map to an HTTP 403 view
}

When it happens

Trigger: ensureServiceAccessIsAllowed(service, registeredService) called with registeredService == null — ServicesManager found no definition matching the service URL (service never registered, registry empty, or lookup key mismatch).

Common situations: Service definition file missing from the registry directory; wrong registry backend configured (pointing at an empty database table); serviceId regex mismatch; registry cache not refreshed after adding services; typo'd service parameter in the request.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Service Management: Unauthorized Service Access. Service
• ServiceManagement: Unauthorized Service Access. Service
• Unauthorized
• Service [ ] is not found in service registry.
• [ ] is not found in the registry or service access is…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/471302d823b487e9. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/RegisteredServiceAccessStrategyUtils.java:44

     * Ensure service access is allowed.
     *
     * @param registeredService the registered service
     */
    public static void ensureServiceAccessIsAllowed(@Nullable final RegisteredService registeredService) {
        ensureServiceAccessIsAllowed(null, registeredService);
    }


    /**
     * Ensure service access is allowed.
     *
     * @param service           the service
     * @param registeredService the registered service
     */
    public static void ensureServiceAccessIsAllowed(@Nullable final Service service, @Nullable final RegisteredService registeredService) {
        val id = service != null ? service.getId() : "unknown";
        if (registeredService == null) {
            LOGGER.warn("Unauthorized Service Access. Service [{}] is not registered in the service registry. "
                + "Review the service access strategy to evaluate policies required for service access", id);
            throw UnauthorizedServiceException.denied("Service " + id + " is not found or is disabled in the service registry.");
        }
        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {
            val msg = String.format("Unauthorized Service Access. Service [%s] is not enabled in service registry. You should "
                + "review the service access strategy to evaluate the conditions and policies required for service access.", id);
            throw UnauthorizedServiceException.denied(msg);
        }
        if (!ensureServiceIsNotExpired(registeredService)) {
            val msg = String.format("Expired service access is denied. Service [%s] has been expired", id);
            throw UnauthorizedServiceException.expired(msg);
        }
    }

    /**
     * Ensure service is not expired.
     *
     * @param registeredService the service

View on GitHub (pinned to e7288fc434)