{"record":{"id":"2ff0447c9af14925","repo":"apereo/cas","slug":"callbackurl-sent-an-unacceptable-response-status","errorCode":null,"errorMessage":"<callbackUrl> sent an unacceptable response status code","messagePattern":"<callbackUrl> sent an unacceptable response status code","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/support/ProxyAuthenticationHandler.java","lineNumber":51,"sourceCode":"                                      final Integer order, final HttpClient httpClient) {\n        super(name, principalFactory, order);\n        this.httpClient = httpClient;\n    }\n\n    @Override\n    public AuthenticationHandlerExecutionResult authenticate(final Credential credential, final Service service) throws Throwable {\n        val httpCredential = (HttpBasedServiceCredential) credential;\n        if (!httpCredential.getService().getProxyPolicy()\n            .isAllowedProxyCallbackUrl(httpCredential.getService(), httpCredential.getCallbackUrl())) {\n            LOGGER.warn(\"Proxy policy for service [{}] cannot authorize the requested callback url [{}].\",\n                httpCredential.getService(), httpCredential.getCallbackUrl());\n            throw new FailedLoginException(httpCredential.getCallbackUrl() + \" cannot be authorized\");\n        }\n\n        LOGGER.debug(\"Attempting to authenticate [{}]\", httpCredential);\n        val callbackUrl = httpCredential.getCallbackUrl();\n        if (!httpClient.isValidEndPoint(callbackUrl)) {\n            throw new FailedLoginException(callbackUrl.toExternalForm() + \" sent an unacceptable response status code\");\n        }\n        val principalId = httpCredential.getCredentialMetadata().getId();\n        val proxyPrincipal = principalFactory.createPrincipal(principalId);\n        return new DefaultAuthenticationHandlerExecutionResult(this, httpCredential, proxyPrincipal);\n    }\n\n    @Override\n    public boolean supports(final Credential credential) {\n        return credential instanceof HttpBasedServiceCredential;\n    }\n\n    @Override\n    public boolean supports(final Class<? extends Credential> clazz) {\n        return HttpBasedServiceCredential.class.isAssignableFrom(clazz);\n    }\n}\n","sourceCodeStart":33,"sourceCodeEnd":68,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/support/ProxyAuthenticationHandler.java#L33-L68","documentation":"A proxy-authentication attempt failed because the HttpBasedServiceCredential's callback URL did not pass the HTTP reachability check: httpClient.isValidEndPoint() returned false, meaning the callback endpoint responded with an unacceptable/non-2xx status or was unreachable. This is the generic guard for the pgtUrl/proxy-callback validation step of the CAS proxy protocol; the input at fault is the service's callback URL.","triggerScenarios":"Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/support/ProxyAuthenticationHandler.java:51 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the callback URL is reachable from the CAS server and returns HTTP 200","Check the service's proxy policy configuration to ensure the callback URL is allowed","Inspect the callback endpoint for outages, TLS issues, or redirects that HttpClient rejects","Confirm network/firewall rules allow the CAS server to reach the callback host"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}