{"record":{"id":"42e86c730d42a401","repo":"apereo/cas","slug":"no-client-credentials-could-be-identified-in-this","errorCode":null,"errorMessage":"No client credentials could be identified in this request","messagePattern":"No client credentials could be identified in this request","errorType":"exception","errorClass":"CredentialsException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java","lineNumber":72,"sourceCode":"\n    private final OAuth20ClientSecretValidator clientSecretValidator;\n\n    private final AuthenticationAttributeReleasePolicy authenticationAttributeReleasePolicy;\n\n    private final OAuth20ProfileScopeToAttributesFilter profileScopeToAttributesFilter;\n\n    private final TicketFactory ticketFactory;\n\n    private final ConfigurableApplicationContext applicationContext;\n\n    @Override\n    public Optional<Credentials> validate(final CallContext callContext, final Credentials credentials) throws CredentialsException {\n        try {\n            val upc = (UsernamePasswordCredentials) credentials;\n            val casCredential = new UsernamePasswordCredential(upc.getUsername(), upc.getPassword());\n            val clientIdAndSecret = requestParameterResolver.resolveClientIdAndClientSecret(callContext);\n            if (StringUtils.isBlank(clientIdAndSecret.getKey())) {\n                throw new CredentialsException(\"No client credentials could be identified in this request\");\n            }\n\n            val clientId = clientIdAndSecret.getKey();\n            val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(servicesManager, clientId);\n            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n\n            val clientSecret = clientIdAndSecret.getRight();\n            if (!clientSecretValidator.validate(registeredService, clientSecret)) {\n                throw new CredentialsException(\"Client Credentials provided is not valid for registered service: \"\n                    + Objects.requireNonNull(registeredService).getName());\n            }\n            val redirectUri = requestParameterResolver.resolveRequestParameter(callContext.webContext(), OAuth20Constants.REDIRECT_URI)\n                .map(String::valueOf).orElse(StringUtils.EMPTY);\n            OAuth20Utils.validateRedirectUri(redirectUri, true);\n            val service = StringUtils.isNotBlank(redirectUri)\n                ? webApplicationServiceFactory.createService(redirectUri)\n                : webApplicationServiceFactory.createService(clientId);\n            service.getAttributes().put(OAuth20Constants.CLIENT_ID, CollectionUtils.wrapList(clientId));","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java#L54-L90","documentation":"Thrown during username/password profile validation in the OAuth authenticator when resolveClientIdAndClientSecret finds no client_id in the request (no basic auth header and no client_id parameter). The authenticator needs both the end-user credentials and an identifiable OAuth client to proceed.","triggerScenarios":"POSTing username/password (grant_type=password style flow) without a client_id request parameter and without HTTP Basic credentials; the parameter resolver returns a blank key and the authenticator aborts before looking up the registered service.","commonSituations":"Frontend omitted client_id from the token/login request; a gateway strips the Authorization header; client sending credentials only as username/password while CAS requires client identification too; typo in parameter name (clientId vs client_id).","solutions":["Include client_id (and client_secret) as request parameters or send them via HTTP Basic auth in the same request","Confirm the OAuth client is registered so a valid client_id is actually accepted by the parameter resolver","Check that no proxy/filter strips the Authorization header or query/body parameters before they reach CAS","Match the exact parameter name expected by the configured request parameter resolver"],"exampleFix":"// before\nPOST /cas/oauth2.0/token  username=user&password=pass\n// after\nPOST /cas/oauth2.0/token  username=user&password=pass&client_id=myclient&client_secret=secret","handlingStrategy":"validation","validationCode":"if (!clientId) throw new Error('client_id is required (body param or Basic auth) before calling the CAS OAuth endpoint');","typeGuard":"const hasClientCredentials = (p) => typeof p.client_id === 'string' && p.client_id.length > 0;","tryCatchPattern":null,"preventionTips":["Always include client_id/client_secret in token or login requests","Confirm no middleware strips the Authorization header","Use the exact parameter names expected by CAS"],"tags":["oauth2","client-credentials","validation"],"backgroundTag":"missing-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}