{"record":{"id":"4c1d496571f57926","repo":"apereo/cas","slug":"cannot-login-user-using-cas-internal-authenticatio","errorCode":null,"errorMessage":"Cannot login user using CAS internal authentication","messagePattern":"Cannot login user using CAS internal authentication","errorType":"exception","errorClass":"CredentialsException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java","lineNumber":113,"sourceCode":"                throw new CredentialsException(\"Could not authenticate the provided credentials\");\n            }\n\n            val principal = buildAuthenticatedPrincipal(authenticationResult, registeredService, service, callContext);\n            val profile = new CommonProfile();\n\n            profile.setId(principal.getId());\n            profile.addAttribute(OAuth20Constants.CLIENT_ID, clientId);\n            profile.addAttributes((Map) principal.getAttributes());\n\n            val authentication = authenticationResult.getAuthentication();\n            val authnAttributes = authenticationAttributeReleasePolicy.getAuthenticationAttributesForRelease(authentication, registeredService);\n            profile.addAuthenticationAttributes(new HashMap<>(authnAttributes));\n\n            LOGGER.debug(\"Authenticated user profile [{}]\", profile);\n            credentials.setUserProfile(profile);\n            return Optional.of(credentials);\n        } catch (final Throwable e) {\n            throw new CredentialsException(\"Cannot login user using CAS internal authentication\", e);\n        }\n    }\n\n    protected Principal buildAuthenticatedPrincipal(final AuthenticationResult authenticationResult,\n                                                    final OAuthRegisteredService registeredService,\n                                                    final Service service, final CallContext callContext) throws Throwable {\n        val authentication = authenticationResult.getAuthentication();\n        val principal = authentication.getPrincipal();\n\n        val usernameContext = RegisteredServiceUsernameProviderContext\n            .builder()\n            .registeredService(registeredService)\n            .service(service)\n            .principal(principal)\n            .applicationContext(applicationContext)\n            .build();\n        val id = registeredService.getUsernameAttributeProvider().resolveUsername(usernameContext);\n        LOGGER.debug(\"Created profile id [{}]\", id);","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/authenticator/OAuth20UsernamePasswordAuthenticator.java#L95-L131","documentation":"Wrapper CredentialsException: any Throwable thrown inside the validate method (service lookup, access checks, secret validation, authentication, profile building) that is not already converted to a specific message is rethrown with this generic message and the original as the cause. It indicates CAS internal login for the OAuth flow failed.","triggerScenarios":"Any failure during username/password profile validation: unknown client_id in the service registry, service access denied, invalid secret, failed end-user authentication, or exceptions while building the principal/profile from the authentication result.","commonSituations":"Registered service not found (unregistered client_id); registered service access strategy blocks the user/service; underlying authentication store unreachable (LDAP down); NPE or policy exception in buildAuthenticatedPrincipal.","solutions":["Inspect the chained cause (getCause) in logs — the real reason is always the wrapped Throwable","Confirm the client_id maps to an existing registered OAuth service and that its access strategy permits the user","Check availability/connectivity of backing authentication stores and the services registry","Reproduce with DEBUG logging on org.apereo.cas.support.oauth to pinpoint the failing step"],"exampleFix":"null","handlingStrategy":"try-catch","validationCode":"const svc = await servicesRegistry.find(clientId);\nif (!svc) throw new Error('client_id is not a registered OAuth service');","typeGuard":null,"tryCatchPattern":"try {\n  await casLogin(creds);\n} catch (e) {\n  if (String(e.message) === 'Cannot login user using CAS internal authentication') {\n    console.error('root cause:', e.cause ?? e);\n  }\n}","preventionTips":["Always inspect the wrapped cause, never just the top message","Register and enable the OAuth client service before testing","Monitor backing stores (registry, LDAP) for availability"],"tags":["oauth2","authentication","wrapped-exception"],"backgroundTag":"authentication-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}