{"record":{"id":"1d1d7d3adecda8f5","repo":"apereo/cas","slug":"not-in-allowed-range","errorCode":null,"errorMessage":" not in allowed range.","messagePattern":" not in allowed range\\.","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteAddressAuthenticationHandler.java","lineNumber":93,"sourceCode":"        LOGGER.debug(\"[{}] is in [{}]/[{}]\", ip, network, netmask);\n        return true;\n    }\n\n    @Override\n    public AuthenticationHandlerExecutionResult authenticate(final Credential credential, final Service service) throws Throwable {\n        val addressCredential = (RemoteAuthenticationCredential) credential;\n        if (this.inetNetmask != null && this.inetNetworkRange != null) {\n            try {\n                val inetAddress = InetAddress.getByName(addressCredential.getRemoteAddress().trim());\n                if (containsAddress(this.inetNetworkRange, this.inetNetmask, inetAddress)) {\n                    return new DefaultAuthenticationHandlerExecutionResult(this, addressCredential,\n                        principalFactory.createPrincipal(addressCredential.getId()));\n                }\n            } catch (final UnknownHostException e) {\n                LOGGER.debug(\"Unknown host [{}]\", addressCredential.getRemoteAddress());\n            }\n        }\n        throw new FailedLoginException(addressCredential.getRemoteAddress() + \" not in allowed range.\");\n    }\n\n    @Override\n    public boolean supports(final Credential credential) {\n        return credential instanceof RemoteAuthenticationCredential;\n    }\n\n    @Override\n    public boolean supports(final Class<? extends Credential> clazz) {\n        return RemoteAuthenticationCredential.class.isAssignableFrom(clazz);\n    }\n\n    /**\n     * Sets ip network range.\n     *\n     * @param ipAddressRange the IP address range that should be allowed trusted logins\n     */\n    public void configureIpNetworkRange(final String ipAddressRange) {","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-generic-remote-webflow/src/main/java/org/apereo/cas/adaptors/generic/remote/RemoteAddressAuthenticationHandler.java#L75-L111","documentation":"RemoteAddressAuthenticationHandler authenticates purely by checking whether the client's IP address falls within the configured allowed IP ranges. When the address is known but outside every configured RemoteAddressIpRangePattern (or the host is unresolvable, swallowed as a debug UnknownHost), it throws FailedLoginException '<address> not in allowed range.'","triggerScenarios":"authenticate() resolves the RemoteAuthenticationCredential's remote address, iterates the configured cas.authn.remote-address.ip-range patterns, none matches (or UnknownHostException is caught and dropped through), so the final statement throws FailedLoginException.","commonSituations":"CAS deployed behind a reverse proxy so the credential carries the proxy/load-balancer IP instead of the client's (X-Forwarded-For not honored); subnet/CIDR configured too narrowly; network renumbering moving clients out of the allowed range; DNS unable to resolve when the entry was configured as a hostname.","solutions":["Add the client's actual IP/subnet to cas.authn.remote-address.ip-range (e.g., 192.168.1.0/24)","If behind a proxy, ensure the credential receives the forwarded client IP (configure the proxy/extractor to use X-Forwarded-For), not the proxy's address","Verify range syntax in the configured RemoteAddressIpRangePattern entries (correct CIDR/netmask format)","If a hostname was configured, confirm DNS resolution on the CAS host — unresolvable hosts are silently treated as failures"],"exampleFix":"// before (application.properties)\ncas.authn.remote-address.ip-range=10.0.0.0/24\n// after — include the actual client subnet\ncas.authn.remote-address.ip-range=10.0.0.0/24,192.168.10.0/24","handlingStrategy":"validation","validationCode":"// pre-check before invoking the handler\nval ranges = casProps.getAuthn().getRemoteAddress().getIpRange();\nval clientIp = request.getRemoteAddr();\nif (ranges.stream().noneMatch(r -> new RemoteAddressIpRangePattern(r).matches(clientIp)))\n    LOGGER.warn(\"Client {} is outside configured remote-address ranges\", clientIp);","typeGuard":null,"tryCatchPattern":"try {\n    result = remoteAddressHandler.authenticate(remoteCredential);\n} catch (FailedLoginException e) {\n    return fallbackToPrimaryAuthHandler(credential);\n}","preventionTips":["Configure ranges to cover all client subnets, including renumbering headroom","Behind a proxy/LB, propagate the real client IP (X-Forwarded-For) into the credential","Validate CIDR syntax when adding ip-range entries","Prefer IP literals over hostnames, or guarantee DNS resolution on CAS hosts"],"tags":["remote-address","ip-range","authentication","network"],"backgroundTag":"ip-not-in-allowed-range","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}