{"record":{"id":"2a25ced4c5f9d964","repo":"apereo/cas","slug":"script-exception","errorCode":null,"errorMessage":"<script exception>","messagePattern":"<script exception>","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java","lineNumber":77,"sourceCode":"        final Map<String, ? extends Serializable> context) throws Throwable {\n\n        if (authentication == null) {\n            LOGGER.warn(\"Authentication attempt is null and cannot satisfy policy\");\n            return AuthenticationPolicyExecutionResult.failure();\n        }\n        \n        initializeWatchableScriptIfNeeded();\n\n        val args = CollectionUtils.<String, Object>wrap(\n            \"authentication\", authentication,\n            \"context\", context,\n            \"applicationContext\", applicationContext,\n            \"logger\", LOGGER);\n        Objects.requireNonNull(executableScript).setBinding(args);\n        val ex = executableScript.execute(args.values().toArray(), Optional.class);\n        if (ex != null && ex.isPresent()) {\n            val exception = (Exception) ex.get();\n            throw new GeneralSecurityException(exception);\n        }\n        return AuthenticationPolicyExecutionResult.success();\n    }\n\n    @Override\n    public boolean shouldResumeOnFailure(final Throwable failure) {\n        val supplier = Unchecked.supplier(() -> {\n            initializeWatchableScriptIfNeeded();\n            val args = CollectionUtils.wrap(\"failure\", failure, \"logger\", LOGGER);\n            Objects.requireNonNull(executableScript).setBinding(args);\n            return Boolean.TRUE.equals(executableScript.execute(\"shouldResumeOnFailure\",\n                Boolean.class, args.values().toArray()));\n        });\n        val result = supplier.get();\n        Assert.notNull(result, \"Authentication policy result cannot be null\");\n        return result;\n    }\n","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java#L59-L95","documentation":"The Groovy authentication-policy script itself signaled failure by returning an Optional<Exception> whose value is present; the policy rethrows that script-produced exception as a GeneralSecurityException so the policy is unsatisfied. It is not a script syntax error — the script executed successfully and deliberately reported a policy violation for the current authentication attempt.","triggerScenarios":"Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/GroovyScriptAuthenticationPolicy.java:77 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the script's returned exception to learn why the policy judged the authentication unsatisfactory","Review the Groovy policy script logic against the authentication/context bindings","Adjust the script or the authentication data so the policy condition passes"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}