{"record":{"id":"0dc841704440bde8","repo":"apereo/cas","slug":"service-management-unauthorized-service-access-s","errorCode":null,"errorMessage":"Service Management: Unauthorized Service Access. Service [%s] is not allowed access via the service registry.","messagePattern":"Service Management: Unauthorized Service Access\\. Service \\[(.+?)\\] is not allowed access via the service registry\\.","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/BaseServiceAuthorizationCheckAction.java","lineNumber":47,"sourceCode":"    private final AuthenticationServiceSelectionPlan authenticationRequestServiceSelectionStrategies;\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext context) {\n        val serviceInContext = WebUtils.getService(context);\n        val service = FunctionUtils.doUnchecked(() -> authenticationRequestServiceSelectionStrategies.resolveService(serviceInContext));\n        if (service == null) {\n            return success();\n        }\n        val registeredService = servicesManager.findServiceBy(service);\n        if (registeredService == null) {\n            val msg = String.format(\"Service [%s] is not found in service registry.\", service.getId());\n            LOGGER.warn(msg);\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            val msg = String.format(\"Service Management: Unauthorized Service Access. \"\n                + \"Service [%s] is not allowed access via the service registry.\", service.getId());\n            LOGGER.warn(msg);\n            WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(context,\n                registeredService.getAccessStrategy().getUnauthorizedRedirectUrl());\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        val delegatedPolicy = registeredService.getAccessStrategy().getDelegatedAuthenticationPolicy();\n        WebUtils.putCasLoginFormViewable(context, delegatedPolicy == null || !delegatedPolicy.isExclusive());\n        return success();\n    }\n}\n","sourceCodeStart":29,"sourceCodeEnd":57,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/BaseServiceAuthorizationCheckAction.java#L29-L57","documentation":"The service IS registered, but its RegisteredServiceAccessStrategy.isServiceAccessAllowed() returned false, so the action throws UnauthorizedServiceException.denied with the 'Service Management: Unauthorized Service Access...' message and puts the access strategy's unauthorizedRedirectUrl into flow scope for redirection.","triggerScenarios":"doExecuteInternal calls isServiceAccessAllowed on the resolved registered service and it returns false due to: service disabled, expired (start/end dates), attribute-based release rules failing for the user, or delegated-auth exclusive policy restrictions.","commonSituations":"Admin disabled the service in the service manager; evaluationOrder/date windows lapsed; required-attributes policy rejects the authenticated principal; user not in an allowed group; scheduled service expiration passed unnoticed.","solutions":["Re-enable the service / fix its accessStrategy (set serviceAccessAllowed=true) in the registry","Check and widen the access strategy's startDate/endDate window","Update requiredAttributes/allowedAttributes so the current principal satisfies the policy","Set an unauthorizedRedirectUrl on the access strategy so end users get a friendly redirect instead of a raw error"],"exampleFix":"// before\n\"accessStrategy\": {\n  \"@class\": \"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy\",\n  \"enabled\": false\n}\n// after\n\"accessStrategy\": {\n  \"@class\": \"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy\",\n  \"enabled\": true,\n  \"unauthorizedRedirectUrl\": \"https://app.example.org/access-denied\"\n}","handlingStrategy":"try-catch","validationCode":"// Precheck access strategy before entering the flow\nRegisteredService rs = servicesManager.findServiceBy(service);\nif (rs != null && !rs.getAccessStrategy().isServiceAccessAllowed(rs, service)) {\n    logger.warn(\"Access denied by policy for {}\", rs.getId());\n}","typeGuard":null,"tryCatchPattern":"try {\n    flow.exec(authorizationCheck);\n} catch (UnauthorizedServiceException e) {\n    // redirect using unauthorizedRedirectUrl from flow scope\n    response.sendRedirect(unauthorizedRedirectUrl);\n}","preventionTips":["Audit accessStrategy enabled flags and date windows on a schedule","Keep requiredAttributes policies in sync with real user attributes","Set unauthorizedRedirectUrl for user-friendly denial handling","Alert when services are disabled via the services manager UI"],"tags":["service-registry","access-strategy","unauthorized-service"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}