{"record":{"id":"0429fe969c542ee4","repo":"apereo/cas","slug":"acr-is-not-defined-as-a-supported-acr-in-cas","errorCode":null,"errorMessage":"ACR [{}] is not defined as a supported ACR in CAS configuration, [{}]","messagePattern":"ACR \\[(.+?)\\] is not defined as a supported ACR in CAS configuration, \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/flow/OidcMultifactorAuthenticationTrigger.java","lineNumber":74,"sourceCode":"    private final FactoryBean<OidcServerDiscoverySettings> discoverySettingsFactory;\n\n    private int order = Ordered.LOWEST_PRECEDENCE;\n\n    @Override\n    public Optional<MultifactorAuthenticationProvider> isActivated(final Authentication authentication,\n                                                                   final RegisteredService registeredService,\n                                                                   final HttpServletRequest request,\n                                                                   final HttpServletResponse response,\n                                                                   final Service service) {\n        val acr = getAuthenticationClassReference(request, response);\n        if (StringUtils.isBlank(acr)) {\n            LOGGER.debug(\"No ACR provided in the authentication request\");\n            return Optional.empty();\n        }\n        val supportedAcrValues = getSupportedAcrValues(authentication, registeredService, request);\n        val values = List.of(org.springframework.util.StringUtils.delimitedListToStringArray(acr, \" \"));\n        if (values.stream().noneMatch(supportedAcrValues::contains)) {\n            LOGGER.warn(\"ACR [{}] is not defined as a supported ACR in CAS configuration, [{}]\", acr, supportedAcrValues);\n            return Optional.empty();\n        }\n\n        val providerMap = MultifactorAuthenticationUtils.getAvailableMultifactorAuthenticationProviders(this.applicationContext);\n        if (providerMap.isEmpty()) {\n            LOGGER.error(\"No multifactor authentication providers are available in the application context to handle [{}]\", values);\n            throw new AuthenticationException(new MultifactorAuthenticationProviderAbsentException());\n        }\n        \n        val authnContexts = casProperties.getAuthn().getOidc().getCore().getAuthenticationContextReferenceMappings();\n        val mappings = CollectionUtils.convertDirectedListToMap(authnContexts);\n        val mappedAcrValues = values\n            .stream()\n            .map(acrValue -> mappings.getOrDefault(acrValue, acrValue))\n            .collect(Collectors.toList());\n        LOGGER.debug(\"Mapped ACR values are [{}] to compare against [{}]\", mappedAcrValues, providerMap.values());\n        return providerMap.values()\n            .stream()","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/flow/OidcMultifactorAuthenticationTrigger.java#L56-L92","documentation":"When an OIDC authorization request carries an acr_values claim, OidcMultifactorAuthenticationTrigger.isActivated checks each requested ACR against the supported ACR values configured for CAS (global + service-level). If none of the requested values is supported, CAS logs this warning and returns Optional.empty() — the MFA trigger is bypassed and authentication continues without the requested MFA.","triggerScenarios":"Authorization request with acr_values whose space-delimited entries match none of the ACRs resolved from getSupportedAcrValues (cas.authn.oidc.acr supported values / registered service acr policy).","commonSituations":"RPs requesting vendor-specific ACR strings not configured in CAS; typos or wrong case in acr_values; MFA provider removed/upgraded so its ACR no longer matches; service-level ACR overrides not updated.","solutions":["Add the requested ACR value to cas.authn.oidc.acr.supported-values (or the equivalent configuration) and ensure the matching MFA provider is registered","Align the RP's acr_values with the ACR names CAS advertises in discovery (acr_values_supported)","Fix casing/spelling — ACR matching is exact containment","Set a default MFA trigger if unauthenticated ACR requests should still force MFA"],"exampleFix":"// before\nGET /oidc/authorize?...&acr_values=mfa_totp   # not in supported ACRs\n# cas.authn.oidc.acr.supported-values=mfa-duo,mfa-webauthn\n// after\ncas.authn.oidc.acr.supported-values=mfa-duo,mfa-webauthn,mfa-totp\n# or request acr_values=mfa-duo","handlingStrategy":"validation","validationCode":"const supported = discovery.acr_values_supported ?? [];\nconst requested = acrValues.split(' ');\nconst usable = requested.filter(a => supported.includes(a));\nif (usable.length === 0) console.warn(`None of [${requested}] are supported; MFA will be skipped: ${supported}`);","typeGuard":"function hasSupportedAcr(requestedAcrs, supportedAcrs) {\n  return requestedAcrs.split(' ').some(a => supportedAcrs.includes(a));\n}","tryCatchPattern":null,"preventionTips":["Read acr_values_supported from discovery before sending acr_values","Keep supported-values in sync with enabled MFA providers","Match ACR strings exactly (case-sensitive)","Handle the 'no MFA triggered' path gracefully in the RP"],"tags":["oidc","acr","mfa","configuration"],"backgroundTag":"unsupported-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}