apereo/cas · error · FailedLoginException

Unable to accept cookie for authentication

Error message

Unable to accept cookie for authentication

What it means

RemoteCookieAuthenticationHandler authenticates users presenting a cookie whose value is encrypted by the remote cookie cipher executor. When decode of the cookie throws (bad key, malformed/garbage cookie, blank principal) the handler catches the exception, logs it, and throws FailedLoginException 'Unable to accept cookie for authentication', so the underlying cause is only visible in logs.

Solutions

1. Check server logs for the LoggingUtils.error stack trace above this exception to see the real decode failure
2. Ensure cas.authn.remote... cipher encryption/signing keys are identical across all CAS nodes and clients issuing the cookie
3. Clear stale cookies and re-obtain a fresh cookie from the issuing service
4. Verify the cookie value is not URL-encoded/truncated in transit before reaching the handler

Example fix

// before: cookie encrypted with mismatched key on node B
// after: align keys in both nodes' properties
# cas.authn.remote-cookie.crypto.encryption.key=...same-value...
# cas.authn.remote-cookie.crypto.signing.key=...same-value...

if (credential == null || credential.getCookie() == null || credential.getCookie().isBlank()) {
    throw new IllegalArgumentException("Remote cookie credential has no cookie value");
}

try {
    return handler.authenticate(credential);
} catch (FailedLoginException e) {
    // inspect server logs for the swallowed decode cause; reject request 401
}

When it happens

Trigger: Calling authenticate() with a RemoteUserCookieAddressCredential whose getCookie() value cannot be decrypted by remoteCookieCipherExecutor.decode() or yields a blank principalId.

Common situations: Cipher/encryption keys changed or differ between nodes issuing and accepting the cookie; cookie was tampered with or truncated; cookie issued by an older CAS version with a different cipher config; cookie expired or forged.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials:
• Cannot validate authentication for: [login]
• Invalid credentials:
• Could not authenticate account for
• Account password on file does not match the provided…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/affb2d5117c4f98f. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteCookieAuthenticationHandler.java:54

        return credential instanceof RemoteAuthenticationCredential;
    }

    @Override
    public boolean supports(final Class<? extends Credential> clazz) {
        return RemoteAuthenticationCredential.class.isAssignableFrom(clazz);
    }

    @Override
    public AuthenticationHandlerExecutionResult authenticate(final Credential credential, final Service service) throws Throwable {
        try {
            val addressCredential = (RemoteAuthenticationCredential) credential;
            val principalId = remoteCookieCipherExecutor.decode(addressCredential.getCookie());
            return new DefaultAuthenticationHandlerExecutionResult(this, addressCredential,
                principalFactory.createPrincipal(principalId));
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        }
        throw new FailedLoginException("Unable to accept cookie for authentication");
    }
}

View on GitHub (pinned to e7288fc434)