apereo/cas · error · AuthenticationException

Unable to accept response status

Error message

Unable to accept response status ${status}

What it means

RestfulIPAddressIntelligenceService calls an external REST IP-intelligence endpoint and throws AuthenticationException when the HTTP response status is 403 FORBIDDEN or 401 UNAUTHORIZED. The service cannot obtain a reputation score, so the IP examination fails rather than silently allowing the request.

Solutions

1. Set the correct authentication credentials for the REST endpoint (e.g. cas.authn.adaptive.ip-intel.rest.basic-auth-username/password or headers).
2. Verify the API key/token is still valid by calling the endpoint with curl using the same credentials.
3. Check proxy/firewall configuration that may strip or alter Authorization headers.
4. If the service intentionally rejects some IPs, wrap/supersede the intel service with a fallback implementation that treats the failure per policy.
5. Review endpoint URL correctness — a wrong path often returns 403 instead of 404.

Example fix

// before
cas.authn.adaptive.ip-intel.rest.url=https://ipintel.example.com/check
// after
cas.authn.adaptive.ip-intel.rest.url=https://ipintel.example.com/check
cas.authn.adaptive.ip-intel.rest.basic-auth-username=mykey
cas.authn.adaptive.ip-intel.rest.basic-auth-password=mysecret

// validate the endpoint and credentials before enabling
var status = HttpUtils.execute(HttpRequest.get(url).build()).getCode();
if (status == 401 || status == 403) { throw new IllegalStateException("IP intel endpoint rejects configured credentials"); }

try {
    response = ipIntelligenceService.examine(ipAddress, service);
} catch (AuthenticationException e) {
    LOGGER.warn("IP intel endpoint returned 401/403; applying configured fallback policy", e);
    return IPAddressIntelligenceResponse.allowed(); // or blocked per policy
}

When it happens

Trigger: Configuring cas.authn.adaptive.ip-intel.rest.url to a protected endpoint and having examineInternal receive an HTTP 401/403 response — typically missing, expired, or invalid API credentials on the outbound request.

Common situations: API key rotated or expired on the third-party IP intelligence service; wrong auth header configured (or none); firewall/proxy rewriting the request; free-tier endpoint that rejects unauthenticated calls.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• No credentials can be extracted to authenticate the REST…
• <policy status exception>
• Unable to extract credentials for multifactor authentication
• Failed: status with message
• Could not authenticate forbidden account for

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/bee578fdf4789299. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/intel/RestfulIPAddressIntelligenceService.java:56

            val parameters = new HashMap<String, String>();
            parameters.put("clientIpAddress", clientIpAddress);

            val exec = HttpExecutionRequest.builder()
                .basicAuthPassword(rest.getBasicAuthPassword())
                .basicAuthUsername(rest.getBasicAuthUsername())
                .method(HttpMethod.GET)
                .url(SpringExpressionLanguageValueResolver.getInstance().resolve(rest.getUrl()))
                .parameters(parameters)
                .headers(rest.getHeaders())
                .maximumRetryAttempts(rest.getMaximumRetryAttempts())
                .build();

            response = HttpUtils.execute(exec);
            if (response != null) {
                val status = HttpStatus.valueOf(response.getCode());
                if (status == HttpStatus.FORBIDDEN || status == HttpStatus.UNAUTHORIZED) {
                    throw new AuthenticationException("Unable to accept response status " + status);
                }
                if (status == HttpStatus.OK || status == HttpStatus.ACCEPTED) {
                    return IPAddressIntelligenceResponse.allowed();
                }
                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {
                    val score = Double.parseDouble(IOUtils.toString(content, StandardCharsets.UTF_8));
                    return IPAddressIntelligenceResponse.builder()
                        .score(score)
                        .status(IPAddressIntelligenceResponse.IPAddressIntelligenceStatus.RANKED)
                        .build();
                }
            }
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        } finally {
            HttpUtils.close(response);
        }
        return IPAddressIntelligenceResponse.banned();

View on GitHub (pinned to e7288fc434)