{"record":{"id":"324e9dd1c2228f6a","repo":"apereo/cas","slug":"denied-s-324e9d","errorCode":null,"errorMessage":"Denied: %s","messagePattern":"Denied: (.+?)","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java","lineNumber":266,"sourceCode":"    protected Optional<ClientCredential> populateContextWithClientCredential(final BaseClient client,\n                                                                             final RequestContext requestContext) {\n        return configContext.getCredentialExtractors()\n            .stream()\n            .filter(BeanSupplier::isNotProxy)\n            .map(extractor -> extractor.extract(client, requestContext))\n            .flatMap(Optional::stream)\n            .findFirst();\n    }\n\n    protected BaseClient findDelegatedClientByName(final String clientName, final RequestContext context) {\n        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);\n        val response = WebUtils.getHttpServletResponseFromExternalWebflowContext(context);\n        \n        val webContext = new JEEContext(request, response);\n        val clientResult = configContext.getIdentityProviders().findClient(clientName, webContext);\n        if (clientResult.isEmpty()) {\n            LOGGER.warn(\"Delegated client [{}] can not be located\", clientName);\n            throw UnauthorizedServiceException.denied(\"Denied: %s\".formatted(clientName));\n        }\n        val client = (BaseClient) clientResult.get();\n        client.init();\n        return client;\n    }\n\n    private void verifyClientIsAuthorizedForService(final RequestContext requestContext, @Nullable final Service service, final BaseClient client) {\n        LOGGER.debug(\"Delegated authentication client is [{}] with service [{}]\", client, service);\n        if (service != null) {\n            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);\n            request.setAttribute(CasProtocolConstants.PARAMETER_SERVICE, service);\n        }\n        if (!isDelegatedClientAuthorizedForService(client, service, requestContext)) {\n            LOGGER.error(\"Delegated client [{}] is not authorized by service [{}]\", client, service);\n            throw UnauthorizedServiceException.denied(\"Denied: %s\".formatted(service));\n        }\n    }\n","sourceCodeStart":248,"sourceCodeEnd":284,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java#L248-L284","documentation":"Delegated client lookup failed: findDelegatedClientByName in DelegatedClientAuthenticationAction cannot resolve the requested identity-provider client name against the pac4j IdentityProviders configuration, so CAS denies access with an UnauthorizedServiceException. This guards against requests naming an unconfigured or unauthorized provider.","triggerScenarios":"A request parameter (e.g. client_name) names a delegated client that is not registered in the DelegatedClientIdentityProviderConfigurationFactory results, is filtered out as unauthorized for the service, or findClient returns empty for the given JEEContext.","commonSituations":"Typo in the client name in links or service config; client disabled by an AuthorizationGenerator/service filter; config change after CAS restart removed the provider; user bookmarked an old SSO link.","solutions":["Verify the clientName parameter matches a pac4j client registered in cas.authn.pac4j.* configuration","Check that no service-level filter (unauthorized redirection policy / custom Authorizer) is excluding the client","Confirm the DelegatedClientIdentityProviderConfigurationFactory includes the client for the requested service","Enable debug logging for org.apereo.cas.support.pac4j.web.flow to see why the client set is empty"],"exampleFix":"// before\ncas.authn.pac4j.oidc[0].client-name = GitHUB\n// after (matches the name used in the request)\ncas.authn.pac4j.oidc[0].client-name = GitHubClient","handlingStrategy":"validation","validationCode":"if (cas.getIdentityProviders().findClient(clientName, webContext).isEmpty()) {\n    // route to an error event instead of invoking the action\n}","typeGuard":null,"tryCatchPattern":"try { ... } catch (UnauthorizedServiceException e) { return errorEvent(\"delegationDenied\", e); }","preventionTips":["Keep delegated client names centralized/shared constants","Verify client availability in integration tests","Monitor the warn log 'Delegated client ... can not be located'"],"tags":["sso","delegated-authentication","pac4j"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}