{"record":{"id":"34c86783561dfda0","repo":"apereo/cas","slug":"unable-to-detect-authenticated-user-profile-for-pr","errorCode":null,"errorMessage":"Unable to detect authenticated user profile for prompt-less login attempts. Redirecting to URL [{}]","messagePattern":"Unable to detect authenticated user profile for prompt-less login attempts\\. Redirecting to URL \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcCallbackAuthorizeViewResolver.java","lineNumber":67,"sourceCode":"                val model = new HashMap<String, String>();\n                model.put(OAuth20Constants.ERROR, OidcConstants.LOGIN_REQUIRED);\n                return new ModelAndView(new JacksonJsonView(), model);\n            }\n            val parameters = new LinkedHashMap<String, String>();\n            parameters.put(OAuth20Constants.ERROR, OidcConstants.LOGIN_REQUIRED);\n            oauthRequestParameterResolver.resolveRequestParameter(context, OAuth20Constants.STATE)\n                .ifPresent(state -> parameters.put(OAuth20Constants.STATE, state));\n            val clientId = oauthRequestParameterResolver.resolveRequestParameter(context, OAuth20Constants.CLIENT_ID).orElse(StringUtils.EMPTY);\n            val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager, clientId);\n\n            OAuth20Utils.validateRedirectUri(originalRedirectUrl.get(), true);\n            val responseType = oauthRequestParameterResolver.resolveResponseModeType(context);\n            val redirect = FunctionUtils.doIf(OAuth20ResponseModeFactory.isResponseModeTypeFormPost(registeredService, responseType),\n                    originalRedirectUrl::get,\n                    () -> OidcRequestSupport.getRedirectUrlWithError(originalRedirectUrl.get(), OidcConstants.LOGIN_REQUIRED, context))\n                .get();\n            return FunctionUtils.doUnchecked(() -> {\n                LOGGER.warn(\"Unable to detect authenticated user profile for prompt-less login attempts. Redirecting to URL [{}]\", redirect);\n                return authorizationModelAndViewBuilder.build(registeredService, responseType, redirect, parameters);\n            });\n        }\n        if (prompt.contains(OidcConstants.PROMPT_LOGIN)) {\n            LOGGER.trace(\"Removing login prompt from URL [{}]\", url);\n            val newUrl = OidcRequestSupport.removeOidcPromptFromAuthorizationRequest(url, OidcConstants.PROMPT_LOGIN);\n            LOGGER.trace(\"Redirecting to URL [{}]\", newUrl);\n            return OAuth20CallbackAuthorizeViewResolver.asDefault().resolve(context, manager, newUrl);\n        }\n        LOGGER.trace(\"Redirecting to URL [{}]\", url);\n        return OAuth20CallbackAuthorizeViewResolver.asDefault().resolve(context, manager, url);\n    }\n\n}\n","sourceCodeStart":49,"sourceCodeEnd":82,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/OidcCallbackAuthorizeViewResolver.java#L49-L82","documentation":"When an OIDC authorization request arrives without an explicit prompt value and CAS cannot detect an already-authenticated user profile in the request context, it cannot silently authorize the request. CAS logs this warning and redirects the user to the login flow, appending an error/status (e.g. login_required for non-form-post response modes) to the original redirect URL.","triggerScenarios":"OidcCallbackAuthorizeViewResolver.resolve processes an authorize/callback URL where prompt is absent or lacks login/none, and the authenticated profile lookup finds nothing (expired SSO session, missing ticket cookie), so CAS falls back to authorizationModelAndViewBuilder.build with a login redirect.","commonSituations":"User's CAS SSO session expired before the prompt-less authorization request; cookies blocked in an iframe so no session profile is detected; CAS nodes behind a load balancer without shared ticket registry; client relies on silent SSO while no session exists.","solutions":["Have the client send an explicit prompt parameter (e.g. prompt=login) so CAS takes a deterministic path.","Ensure CAS SSO sessions are valid: verify ticket registry replication across nodes and session timeout settings.","Check browser cookie settings/third-party cookie blocking if the flow runs in an iframe.","Confirm the user logged in to CAS before the OIDC request; the redirect is usually correct behavior, not a defect.","If redirect loops occur, inspect the built redirect URL and response mode to confirm the client handles the login_required error."],"exampleFix":"// before\nGET /cas/oidc/authorize?client_id=app&response_type=code&redirect_uri=...\n// after\nGET /cas/oidc/authorize?client_id=app&response_type=code&prompt=login&redirect_uri=...","handlingStrategy":"fallback","validationCode":"// Client-side: check for an existing CAS session cookie before a prompt-less authorize call;\nboolean hasCasSsoSession(jakarta.servlet.http.HttpServletRequest req) {\n    return req.getCookies() != null && java.util.Arrays.stream(req.getCookies())\n        .anyMatch(c -> c.getName().startsWith(\"TGC\"));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Send an explicit prompt parameter (login/consent) when silent SSO is not a requirement.","Ensure the ticket registry is shared/replicated across all CAS nodes behind the load balancer.","Avoid embedding the authorize flow in third-party iframes where cookies may be blocked.","Handle the login_required / login redirect in the OIDC client instead of assuming silent success."],"tags":["oidc","sso","session","redirect"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}