{"record":{"id":"2397f23105908271","repo":"apereo/cas","slug":"provided-client-id-cannot-be-matched-against","errorCode":null,"errorMessage":"Provided client id [{}] cannot be matched against a service definition","messagePattern":"Provided client id \\[(.+?)\\] cannot be matched against a service definition","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20RevocationRequestValidator.java","lineNumber":45,"sourceCode":"@Getter\n@Setter\npublic class OAuth20RevocationRequestValidator implements OAuth20TokenRequestValidator {\n    private final ServicesManager servicesManager;\n\n    private final SessionStore sessionStore;\n\n    private final OAuth20RequestParameterResolver requestParameterResolver;\n\n    private int order = Ordered.LOWEST_PRECEDENCE;\n\n    @Override\n    public boolean validate(final WebContext context) {\n        val callContext = new CallContext(context, sessionStore);\n        val clientId = requestParameterResolver.resolveClientIdAndClientSecret(callContext).getLeft();\n        val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(this.servicesManager, clientId);\n\n        if (registeredService == null) {\n            LOGGER.warn(\"Provided client id [{}] cannot be matched against a service definition\", clientId);\n            return false;\n        }\n        return true;\n    }\n\n    @Override\n    public boolean supports(final WebContext context) {\n        val token = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.TOKEN)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        if (StringUtils.isBlank(token)) {\n            return false;\n        }\n\n        val callContext = new CallContext(context, sessionStore);\n        val clientId = requestParameterResolver.resolveClientIdAndClientSecret(callContext).getLeft();\n        return StringUtils.isNotBlank(clientId);\n    }\n}","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20RevocationRequestValidator.java#L27-L63","documentation":"OAuth20RevocationRequestValidator.validate() resolves the clientId from the revocation request and looks it up in the ServicesManager. When no registered OAuth service matches the clientId, it warns and returns false, so the RFC 7009 token revocation request is refused.","triggerScenarios":"A POST to the OAuth revocation endpoint with a client_id (from parameter or Basic auth) that has no corresponding registered service in the CAS services registry — unregistered client, wrong environment's registry, or typo.","commonSituations":"Client registered in production but pointing at a staging CAS; services registry not loaded/synced (JSON file missing, JDBC empty); clientId misspelled; registry entry deleted or disabled so it no longer matches.","solutions":["Register the clientId as an OAuth service definition in the CAS services registry and deploy/reload it.","Verify the CAS instance is talking to the intended services registry for that environment.","Check the clientId in the request (parameter or Basic auth header) for typos or stale values.","Confirm the service is enabled and its clientId actually matches what the client sends."],"exampleFix":"// before (registry)\n{\"@class\":\"...OAuthRegisteredService\",\"serviceId\":\"https://app.example.com\",\"clientId\":\"wrongId\"}\n// after\n{\"@class\":\"...OAuthRegisteredService\",\"serviceId\":\"https://app.example.com\",\"clientId\":\"correct-client-id\"}","handlingStrategy":"validation","validationCode":"const svc = await servicesRegistry.findByClientId(clientId);\nif (!svc) {\n  throw new Error(`clientId ${clientId} is not registered in the CAS services registry`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register every client before enabling it against a CAS environment","Sync services registry across environments deliberately; don't assume parity","Verify env-specific CAS endpoints in client config"],"tags":["oauth","revocation","unregistered-client","service-registry"],"backgroundTag":"record-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}