apereo/cas · error · FailedLoginException

Unable to authenticate

Error message

Unable to authenticate <credentialId>

What it means

The JAAS authentication handler could not produce a principal from the JAAS LoginContext for the given username/password credential: authenticateAndGetPrincipal() returned null or no password-policy strategy could be applied, so authentication definitively failed. This is the terminal failure path after JAAS login throws no resolvable outcome — the credential did not authenticate against the configured JAAS realm/login module.

Solutions

1. Verify the JAAS login configuration (login.conf) and realm match a valid LoginModule
2. Check JAAS debug output/logs for the underlying LoginException (bad credentials, account locked, etc.)
3. Confirm kerberosKdcSystemProperty/kerberosRealmSystemProperty settings if Kerberos-backed
4. Ensure the username exists in the backing JAAS realm

When it happens

Trigger: Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/support/jaas/JaasAuthenticationHandler.java:112 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/7c598f8982227b0e. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/support/jaas/JaasAuthenticationHandler.java:112

        final UsernamePasswordCredential credential,
        @Nullable final String originalPassword) throws Throwable {
        if (StringUtils.isNotBlank(this.kerberosKdcSystemProperty)) {
            LOGGER.debug("Configured kerberos system property [{}] to [{}]", SYS_PROP_KERB5_KDC, this.kerberosKdcSystemProperty);
            System.setProperty(SYS_PROP_KERB5_KDC, this.kerberosKdcSystemProperty);
        }
        if (StringUtils.isNotBlank(this.kerberosRealmSystemProperty)) {
            LOGGER.debug("Setting kerberos system property [{}] to [{}]", SYS_PROP_KRB5_REALM, this.kerberosRealmSystemProperty);
            System.setProperty(SYS_PROP_KRB5_REALM, this.kerberosRealmSystemProperty);
        }

        val principal = authenticateAndGetPrincipal(credential);
        val strategy = getPasswordPolicyHandlingStrategy();
        if (principal != null && strategy != null) {
            LOGGER.debug("Attempting to examine and handle password policy via [{}]", strategy.getClass().getSimpleName());
            val messageList = strategy.handle(principal, getPasswordPolicyConfiguration());
            return createHandlerResult(credential, principal, messageList);
        }
        throw new FailedLoginException("Unable to authenticate " + credential.getId());
    }

    /**
     * Authenticate and get principal.
     *
     * @param credential the credential
     * @return the principal
     * @throws GeneralSecurityException the general security exception
     */
    protected @Nullable Principal authenticateAndGetPrincipal(final UsernamePasswordCredential credential) throws Throwable {
        val lc = getLoginContext(credential);
        try {
            lc.login();
            val principals = lc.getSubject().getPrincipals();
            LOGGER.debug("JAAS principals extracted from subject are [{}]", principals);
            if (principals != null && !principals.isEmpty()) {
                val secPrincipal = principals.iterator().next();
                LOGGER.debug("JAAS principal detected from subject login context is [{}]", secPrincipal.getName());

View on GitHub (pinned to e7288fc434)