{"record":{"id":"14bcfa4b66d8f76c","repo":"apereo/cas","slug":"configured-login-config-for-cas-under-will-be","errorCode":null,"errorMessage":"Configured login config for CAS under [{}] will be ignored","messagePattern":"Configured login config for CAS under \\[(.+?)\\] will be ignored","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-spnego/src/main/java/org/apereo/cas/support/spnego/authentication/handler/support/JcifsConfig.java","lineNumber":41,"sourceCode":"\n    /**\n     * Individual properties collected from CAS settings for each authentication attempt and object.\n     * These settings are fed to the Spnego authentication object\n     */\n    public static class SystemSettings {\n\n        /**\n         * Initialize.\n         *\n         * @param resourceLoader the resource loader\n         * @param loginConf      the login conf\n         */\n        public static void initialize(final ResourceLoader resourceLoader, final String loginConf) {\n            val propValue = System.getProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF);\n            if (StringUtils.isNotBlank(propValue)) {\n                LOGGER.info(\"Found login config [{}] in system property [{}]\", propValue, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);\n                if (StringUtils.isNotBlank(loginConf)) {\n                    LOGGER.warn(\"Configured login config for CAS under [{}] will be ignored\", loginConf);\n                }\n            } else {\n                val effectiveLoginConf = StringUtils.isBlank(loginConf) ? \"/login.conf\" : loginConf;\n                LOGGER.debug(\"Attempting to load login config from [{}]\", effectiveLoginConf);\n\n                val res = resourceLoader.getResource(effectiveLoginConf);\n                if (res.exists()) {\n                    val urlPath = FunctionUtils.doUnchecked(() -> res.getURL().toExternalForm());\n                    LOGGER.debug(\"Located login config [{}] and configured it under [{}]\", urlPath, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);\n                    System.setProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF, urlPath);\n                } else {\n                    val url = JcifsConfig.class.getResource(\"/jcifs/http/login.conf\");\n                    if (url != null) {\n                        val fullUrl = url.toExternalForm();\n                        LOGGER.debug(\"Falling back unto default login config [{}] under [{}]\", fullUrl, JcifsConfigConstants.SYS_PROP_LOGIN_CONF);\n                        System.setProperty(JcifsConfigConstants.SYS_PROP_LOGIN_CONF, fullUrl);\n                    }\n                }","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-spnego/src/main/java/org/apereo/cas/support/spnego/authentication/handler/support/JcifsConfig.java#L23-L59","documentation":"JcifsConfig.initialize sets the jcifs/java login configuration (java.security.auth.login.config) for SPNEGO/JCIFS. If the login config is already supplied via the system property (e.g. -Djava.security.auth.login.config=...), CAS logs that the loginConf configured in CAS properties is ignored rather than overriding the JVM-level setting. The system property wins by design.","triggerScenarios":"initialize(resourceLoader, loginConf) is called while System.getProperty(jcifs.sysprop.login.conf) is already set to a non-blank value AND the CAS-side loginConf property is also non-blank.","commonSituations":"Container/JVM startup flags (JAVA_OPTS, JAVA_TOOL_OPTIONS, tomcat.conf) set java.security.auth.login.config while the CAS properties file also defines cas.authn.spnego[...].jcifs... login-conf; duplicate configuration after a migration; someone added the sysprop to 'fix' Kerberos earlier and forgot.","solutions":["Remove the CAS properties login-conf setting and rely on the system property, or vice versa - keep exactly one source.","Delete the -Djava.security.auth.login.config JVM flag if the CAS-managed login.conf should win.","Confirm which login.conf file is actually in effect by checking the INFO log line above the warning.","Document the chosen source of truth to prevent future duplicate configuration."],"exampleFix":"// before\nJAVA_OPTS=\"$JAVA_OPTS -Djava.security.auth.login.config=/etc/cas/jaas.conf\"\n# plus cas.authn.spnego.login-conf=/etc/cas/jaas.conf\n// after\nJAVA_OPTS=\"$JAVA_OPTS\"  # let CAS properties own the login config\ncas.authn.spnego.login-conf=/etc/cas/jaas.conf","handlingStrategy":"validation","validationCode":"if (System.getProperty(\"java.security.auth.login.config\") != null) {\n    // skip setting login-conf in CAS properties; sysprop already wins\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Single source of truth for JAAS login config","Grep JVM flags (JAVA_OPTS, JAVA_TOOL_OPTIONS) before adding CAS-side config","Log effective config at startup"],"tags":["jcifs","spnego","jaas","configuration-conflict"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}