apereo/cas · warning

Unexpected activationStatus

Error message

Unexpected activationStatus: [{}]

What it means

This WARN log is emitted by InweboCheckUserAction.doExecuteInternal when the Inwebo API returns an activationStatus value (2 or 3) that the MFA flow does not map to any authentication event. The action branches on known statuses (push-capable, browser-authenticator, etc.) and logs anything else as unexpected, then falls through without returning a custom event. The user's Inwebo device state is in a mode CAS cannot handle, so the flow proceeds on an undefined path.

Solutions

1. Inspect the user's device state in the Inwebo administration console and re-synchronize or reactivate the device so it reaches a supported status (1=software, 4=push, 5=browser, etc.)
2. Upgrade CAS / the inwebo support module to a version that maps activationStatus 2 and 3 to explicit flow events
3. Add custom handling in your flow (or subclass InweboCheckUserAction) to return a defined event for statuses 2 and 3 instead of falling through
4. Confirm the Inwebo service ID/API credentials are correct, since mismatched service configuration can surface odd status codes

Example fix

// before
} else if (activationStatus == 2 || activationStatus == 3) {
    LOGGER.warn("Unexpected activationStatus: [{}]", activationStatus);
}
// after
} else if (activationStatus == 2 || activationStatus == 3) {
    LOGGER.warn("Unexpected activationStatus: [{}]", activationStatus);
    return customEvent(DEVICE_PENDING_OR_BLOCKED);
}

const supportedStatuses = [1, 4, 5];
if (!supportedStatuses.includes(activationStatus)) { console.warn('Unsupported Inwebo activationStatus: ' + activationStatus); }

try { val result = inweboCheckUserAction.execute(context); } catch (Exception e) { LOGGER.warn("Inwebo check failed; falling back to denial event", e); return errorEvent(); }

When it happens

Trigger: Inwebo web service returns activationStatus == 2 or 3 (per Inwebo API, states such as 'pending synchronization' or other non-authenticatable device states) during checkAuth during the MFA webflow; a user whose only devices are in those states authenticates with cas-server-support-inwebo-mfa enabled.

Common situations: Users with newly added but not yet synchronized Inwebo devices; devices disabled/blocked on the Inwebo admin console; Inwebo server/API version upgrade that changed or added status codes not yet handled by this CAS version.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• State [ : : ] does not have a matching transition for
• Unknown Duo Security authentication attempt
• Failed to authenticate code
• Unauthorized account registration attempt for id
• Failed to authenticate code

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/a692dd9f509b8899. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/web/flow/actions/InweboCheckUserAction.java:96

                }

                if (activationStatus == 0) {
                    LOGGER.debug("User is not registered: [{}]", login);
                    if (isVirtualAuthenticator) {
                        return customEvent(VA);
                    } else if (isMAccessWeb) {
                        flowScope.put(MUST_ENROLL, true);
                        WebUtils.addErrorMessageToContext(requestContext, "cas.inwebo.error.usernotregistered");
                    }

                } else if (activationStatus == 1) {
                    LOGGER.debug("User can only handle push notifications: [{}]", login);
                    if (pushEnabled) {
                        return customEvent(PUSH);
                    }

                } else if (activationStatus == 2 || activationStatus == 3) {
                    LOGGER.warn("Unexpected activationStatus: [{}]", activationStatus);

                } else if (activationStatus == BROWSER_AUTHENTICATION_STATUS) {
                    LOGGER.debug("User can only handle browser authentication: [{}]", login);
                    if (isVirtualAuthenticator) {
                        return customEvent(VA);
                    } else if (isMAccessWeb) {
                        return customEvent(MA);
                    }

                } else if (activationStatus == PUSH_AND_BROWSER_AUTHENTICATION_STATUS) {
                    LOGGER.debug("User has both authentication methods: [{}]", login);
                    if (pushEnabled) {
                        if (isVirtualAuthenticator || isMAccessWeb) {
                            return customEvent(SELECT);
                        }
                        return customEvent(PUSH);
                    } else {
                        if (isVirtualAuthenticator) {

View on GitHub (pinned to e7288fc434)