{"record":{"id":"060e9f2f98338a70","repo":"apereo/cas","slug":"client-ip-is-rejected-for-authentication-beca","errorCode":null,"errorMessage":"Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]","messagePattern":"Client IP \\[(.+?)\\] is rejected for authentication because intelligence score \\[(.+?)\\] is higher than the configured risk threshold \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java","lineNumber":91,"sourceCode":"    }\n\n    private boolean isUserAgentRejected(final String userAgent) {\n        val rejectBrowsers = this.adaptiveAuthenticationProperties.getPolicy().getRejectBrowsers();\n        return StringUtils.isNotBlank(rejectBrowsers)\n               && RegexUtils.find(rejectBrowsers, userAgent);\n    }\n\n    private boolean isIpAddressRejected(final RequestContext requestContext, final String clientIp) throws Throwable {\n        LOGGER.trace(\"Located client IP address as [{}]\", clientIp);\n        val ipResult = ipAddressIntelligenceService.examine(requestContext, clientIp);\n        if (ipResult == null || ipResult.isBanned()) {\n            LOGGER.warn(\"Client IP [{}] is banned\", clientIp);\n            return true;\n        }\n        if (ipResult.isRanked()) {\n            val threshold = adaptiveAuthenticationProperties.getRisk().getCore().getThreshold();\n            if (ipResult.getScore() >= threshold) {\n                LOGGER.warn(\"Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]\",\n                    clientIp, ipResult.getScore(), threshold);\n                return true;\n            }\n        }\n        return false;\n    }\n}\n","sourceCodeStart":73,"sourceCodeEnd":99,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java#L73-L99","documentation":"When the IP intelligence result is ranked (scored), isIpAddressRejected compares the score against cas.authn.adaptive.risk.core.threshold and rejects the request if score >= threshold. This warning tells you the numeric risk score attributed to the client IP exceeded the configured cutoff.","triggerScenarios":"ipResult.isRanked() is true and ipResult.getScore() >= adaptiveAuthenticationProperties.getRisk().getCore().getThreshold() while examining the client IP.","commonSituations":"Threshold set too low for the risk provider's score scale; shared IP (university/office NAT) with moderate score; noisy third-party risk feed assigning high scores.","solutions":["Raise cas.authn.adaptive.risk.core.threshold to a value above typical benign-IP scores","Tune or replace the IP intelligence/risk provider or calibrate its scores","Exempt the offending IP range if it is a trusted shared network"],"exampleFix":"// before\ncas.authn.adaptive.risk.core.threshold=30\n// after\ncas.authn.adaptive.risk.core.threshold=80","handlingStrategy":"validation","validationCode":"var r = ipIntel.examine(ctx, ip); if (r != null && r.isRanked() && r.getScore() >= props.getRisk().getCore().getThreshold()) { /* pre-check before auth */ }","typeGuard":"boolean scoreWithinThreshold(IPIntelligenceResult r, double threshold) { return r == null || !r.isRanked() || r.getScore() < threshold; }","tryCatchPattern":null,"preventionTips":["Calibrate threshold against your risk provider's score distribution","Log scores in debug mode when tuning","Re-evaluate thresholds after provider changes"],"tags":["risk-score","ip-intelligence","threshold","adaptive-authentication"],"backgroundTag":"value-out-of-range","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}