apereo/cas · error · BadRestRequestException

Unable to establish authentication using provided…

Error message

Unable to establish authentication using provided credentials for ${username}

What it means

In RegisteredServiceResource.authenticateRequest, after extracting Basic-auth credentials and calling authenticationSystemSupport.finalizeAuthenticationTransaction, a null result means authentication could not be established for the supplied username. It is surfaced as BadRestRequestException: the credentials were present but the authentication transaction failed to produce a result.

Solutions

Verify the Basic-auth username/password is correct and test it against the configured authentication source.
Check the logs of the underlying authentication handler for the real failure reason (bind failure, user not found, disabled account).
Confirm the authentication source used by the services REST endpoint is up and reachable.
Review authentication policy/requirements (e.g. required handler) that may reject the credential even if the password is correct.

Example fix

// before
curl -u casadmin:wrongpass -X POST 'https://cas/v1/services' -d '{...}'
// after
curl -u casadmin:correctpass -X POST 'https://cas/v1/services' -d '{...}'

Defensive patterns

Strategy: try-catch

Validate before calling

// Verify credentials are non-empty and correctly Base64-encoded before sending
Objects.requireNonNull(username, "username");
Objects.requireNonNull(password, "password");
String header = "Basic " + Base64.getEncoder().encodeToString((username + ":" + password).getBytes(StandardCharsets.UTF_8));

Try / catch

try { result = authenticateRequest(request); }
catch (BadRestRequestException e) {
    logger.error("Authentication transaction failed for management API; check handler logs and credentials");
    return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Management credentials rejected");
}

Prevention

Validate admin credentials against the backend auth source before deploying automation.
Monitor the authentication handler (LDAP/REST) health; outages surface as this error.
Confirm the username is permitted by the management authentication policy.
Log the actual handler failure from CAS logs rather than guessing from the 400 response.

When it happens

Trigger: POST/PUT/DELETE to /v1/services with a valid-format Basic auth header whose username/password fail authentication; the configured REST authentication handler is unavailable or returns no handler result; authenticationSystemSupport returns null because no authentication transaction could be finalized for the synthetic service request.

Common situations: Wrong password in the automation script's -u option; the authentication backend (LDAP/REST source configured for management auth) is down or unreachable; credentials valid for CAS login but not for the management authentication policy; serviceFactory cannot create a service from the management request.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4c2321319f235b0c. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-rest-services/src/main/java/org/apereo/cas/support/rest/RegisteredServiceResource.java:126

        val pattern = RegexUtils.createPattern(this.attributeValue);
        if (attributes.containsKey(this.attributeName)) {
            val values = CollectionUtils.toCollection(attributes.get(this.attributeName));
            return values.stream().anyMatch(t -> RegexUtils.matches(pattern, t.toString()));
        }
        return false;
    }

    private @Nullable Authentication authenticateRequest(final HttpServletRequest request) {
        val converter = new BasicAuthenticationConverter();
        val token = converter.convert(request);
        return FunctionUtils.doIfNotNull(token, () -> {
            val principal = Objects.requireNonNull(Objects.requireNonNull(token).getPrincipal());
            LOGGER.debug("Received basic authentication ECP request from credentials [{}]", principal);
            val upc = new UsernamePasswordCredential(principal.toString(), Objects.requireNonNull(token.getCredentials()).toString());
            val serviceRequest = this.serviceFactory.createService(request);
            val result = authenticationSystemSupport.finalizeAuthenticationTransaction(serviceRequest, upc);
            if (result == null) {
                throw new BadRestRequestException("Unable to establish authentication using provided credentials for " + upc.getUsername());
            }
            return result.getAuthentication();
        });
    }
}

View on GitHub (pinned to e7288fc434)