{"record":{"id":"2500808e08fa62e6","repo":"apereo/cas","slug":"client-ip-is-rejected-for-authentication","errorCode":null,"errorMessage":"Client IP [{}] is rejected for authentication","messagePattern":"Client IP \\[(.+?)\\] is rejected for authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java","lineNumber":43,"sourceCode":"public class DefaultAdaptiveAuthenticationPolicy implements AdaptiveAuthenticationPolicy {\n\n    private final GeoLocationService geoLocationService;\n\n    private final IPAddressIntelligenceService ipAddressIntelligenceService;\n\n    private final AdaptiveAuthenticationProperties adaptiveAuthenticationProperties;\n\n    @Override\n    public boolean isAuthenticationRequestAllowed(final RequestContext requestContext, final String userAgent,\n                                                  final GeoLocationRequest location) throws Throwable {\n        val clientInfo = ClientInfoHolder.getClientInfo();\n        if (clientInfo == null || StringUtils.isBlank(userAgent)) {\n            LOGGER.warn(\"No client IP or user-agent was provided. Skipping adaptive authentication policy...\");\n            return true;\n        }\n        val clientIp = clientInfo.getClientIpAddress();\n        if (isIpAddressRejected(requestContext, clientIp)) {\n            LOGGER.warn(\"Client IP [{}] is rejected for authentication\", clientIp);\n            return false;\n        }\n\n        if (isUserAgentRejected(userAgent)) {\n            LOGGER.warn(\"User agent [{}] is rejected for authentication\", userAgent);\n            return false;\n        }\n        LOGGER.debug(\"User agent [{}] is authorized to proceed\", userAgent);\n        if (this.geoLocationService != null && location != null && StringUtils.isNotBlank(clientIp)\n            && StringUtils.isNotBlank(this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries())) {\n            val loc = this.geoLocationService.locate(clientIp, location);\n            if (loc != null) {\n                LOGGER.debug(\"Determined geolocation for [{}] to be [{}]\", clientIp, loc);\n                if (isGeoLocationCountryRejected(loc)) {\n                    LOGGER.warn(\"Client [{}] is rejected for authentication based on country location\", clientIp);\n                    return false;\n                }\n            } else {","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java#L25-L61","documentation":"DefaultAdaptiveAuthenticationPolicy rejects the authentication request (returns false) when the client's IP address is on the rejected-IP list configured under cas.authn.adaptive.policy.reject-ip-addresses. The warning records the offending IP.","triggerScenarios":"isIpAddressRejected(requestContext, clientIp) matches the resolved client IP against the configured rejected IP ranges; triggered after client info and user-agent are present.","commonSituations":"Legitimate users behind shared NAT/proxies whose egress IP was blacklisted; IPs captured from a proxy misconfiguration (server IP forwarded instead of client IP); CIDR misconfiguration accidentally matching wide ranges.","solutions":["Remove or correct the client's IP in cas.authn.adaptive.policy.reject-ip-addresses.","Verify the forwarded-headers/proxy setup so the true client IP (not the proxy IP) is evaluated.","Check CIDR notation in the reject list for over-broad ranges (e.g. 10.0.0.0/8).","If dynamic, consider an allowlist or updated risk-based configuration instead of static IP rejection."],"exampleFix":"// before\ncas.authn.adaptive.policy.reject-ip-addresses=10.0.0.0/8\n// after: narrow to the offending host\ncas.authn.adaptive.policy.reject-ip-addresses=10.1.2.3","handlingStrategy":"validation","validationCode":"val rejected = adaptiveProps.getPolicy().getRejectIpAddresses();\nval clientIp = ClientInfoHolder.getClientInfo().getClientIpAddress();\nif (IPAddressMatcher.matchesAny(rejected, clientIp)) {\n    LOGGER.warn(\"Client {} will be rejected by adaptive policy\", clientIp);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit reject-ip-addresses CIDR ranges for over-broad matches.","Confirm X-Forwarded-For handling so real client IPs, not proxy IPs, are evaluated.","Document the de-listing procedure for shared NAT egress IPs."],"tags":["adaptive-authentication","ip-rejection","access-control"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}