{"record":{"id":"471302d823b487e9","repo":"apereo/cas","slug":"service-s-is-not-found-or-is-disabled-in-the-serv","errorCode":null,"errorMessage":"Service %s is not found or is disabled in the service registry.","messagePattern":"Service (.+?) is not found or is disabled in the service registry\\.","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":403,"severity":"error","filePath":"core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/RegisteredServiceAccessStrategyUtils.java","lineNumber":44,"sourceCode":"     * Ensure service access is allowed.\n     *\n     * @param registeredService the registered service\n     */\n    public static void ensureServiceAccessIsAllowed(@Nullable final RegisteredService registeredService) {\n        ensureServiceAccessIsAllowed(null, registeredService);\n    }\n\n\n    /**\n     * Ensure service access is allowed.\n     *\n     * @param service           the service\n     * @param registeredService the registered service\n     */\n    public static void ensureServiceAccessIsAllowed(@Nullable final Service service, @Nullable final RegisteredService registeredService) {\n        val id = service != null ? service.getId() : \"unknown\";\n        if (registeredService == null) {\n            LOGGER.warn(\"Unauthorized Service Access. Service [{}] is not registered in the service registry. \"\n                + \"Review the service access strategy to evaluate policies required for service access\", id);\n            throw UnauthorizedServiceException.denied(\"Service \" + id + \" is not found or is disabled in the service registry.\");\n        }\n        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            val msg = String.format(\"Unauthorized Service Access. Service [%s] is not enabled in service registry. You should \"\n                + \"review the service access strategy to evaluate the conditions and policies required for service access.\", id);\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        if (!ensureServiceIsNotExpired(registeredService)) {\n            val msg = String.format(\"Expired service access is denied. Service [%s] has been expired\", id);\n            throw UnauthorizedServiceException.expired(msg);\n        }\n    }\n\n    /**\n     * Ensure service is not expired.\n     *\n     * @param registeredService the service","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-services-api/src/main/java/org/apereo/cas/services/RegisteredServiceAccessStrategyUtils.java#L26-L62","documentation":"RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed validates that a service is registered and its access strategy permits access. If the RegisteredService is null (no definition found for the service) UnauthorizedServiceException.denied is thrown with a message that the service is not found or disabled. This is the guard used before granting access/issuing tickets.","triggerScenarios":"ensureServiceAccessIsAllowed(service, registeredService) called with registeredService == null — ServicesManager found no definition matching the service URL (service never registered, registry empty, or lookup key mismatch).","commonSituations":"Service definition file missing from the registry directory; wrong registry backend configured (pointing at an empty database table); serviceId regex mismatch; registry cache not refreshed after adding services; typo'd service parameter in the request.","solutions":["Register the service (JSON/YAML/etc.) so ServicesManager can resolve it, with a serviceId pattern matching the requested URL","Verify ServicesManager loaded the service (logs or /services admin UI); reload the registry if hot-reload is not enabled","Fix the serviceId regex to match the actual URL including scheme and trailing path","Confirm the correct service registry storage is configured and reachable"],"exampleFix":"// before: registry lookup returns null\n// RegisteredService rs = servicesManager.findServiceBy(service); // null\n// after: register matching definition first\n// {\"@class\":\"org.apereo.cas.services.RegexRegisteredService\",\"serviceId\":\"^https://app.example.org/cb\",\"id\":100,\"accessStrategy\":{\"@class\":\"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy\",\"enabled\":true,\"ssoEnabled\":true}}","handlingStrategy":"try-catch","validationCode":"RegisteredService rs = servicesManager.findServiceBy(service).orElse(null);\nif (rs == null || !rs.getAccessStrategy().isServiceAccessAllowed(rs, service)) {\n    // deny early with a clear message to the application owner\n}","typeGuard":null,"tryCatchPattern":"try {\n    RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(service, registeredService);\n} catch (UnauthorizedServiceException e) {\n    LOGGER.warn(\"Service access denied: {}\", e.getMessage());\n    throw e; // or map to an HTTP 403 view\n}","preventionTips":["Register every integrating application in the service registry","Verify registry backend contents after environment migrations","Audit accessStrategy.enabled flags on service definitions","Check ServicesManager logs for load counts on startup"],"tags":["unauthorized-service","service-registry","access-strategy"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}