{"record":{"id":"4c2321319f235b0c","repo":"apereo/cas","slug":"unable-to-establish-authentication-using-provided","errorCode":null,"errorMessage":"Unable to establish authentication using provided credentials for ${username}","messagePattern":"Unable to establish authentication using provided credentials for (.+?)","errorType":"exception","errorClass":"BadRestRequestException","httpStatus":400,"severity":"error","filePath":"support/cas-server-support-rest-services/src/main/java/org/apereo/cas/support/rest/RegisteredServiceResource.java","lineNumber":126,"sourceCode":"        val pattern = RegexUtils.createPattern(this.attributeValue);\n        if (attributes.containsKey(this.attributeName)) {\n            val values = CollectionUtils.toCollection(attributes.get(this.attributeName));\n            return values.stream().anyMatch(t -> RegexUtils.matches(pattern, t.toString()));\n        }\n        return false;\n    }\n\n    private @Nullable Authentication authenticateRequest(final HttpServletRequest request) {\n        val converter = new BasicAuthenticationConverter();\n        val token = converter.convert(request);\n        return FunctionUtils.doIfNotNull(token, () -> {\n            val principal = Objects.requireNonNull(Objects.requireNonNull(token).getPrincipal());\n            LOGGER.debug(\"Received basic authentication ECP request from credentials [{}]\", principal);\n            val upc = new UsernamePasswordCredential(principal.toString(), Objects.requireNonNull(token.getCredentials()).toString());\n            val serviceRequest = this.serviceFactory.createService(request);\n            val result = authenticationSystemSupport.finalizeAuthenticationTransaction(serviceRequest, upc);\n            if (result == null) {\n                throw new BadRestRequestException(\"Unable to establish authentication using provided credentials for \" + upc.getUsername());\n            }\n            return result.getAuthentication();\n        });\n    }\n}\n","sourceCodeStart":108,"sourceCodeEnd":132,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-rest-services/src/main/java/org/apereo/cas/support/rest/RegisteredServiceResource.java#L108-L132","documentation":"In RegisteredServiceResource.authenticateRequest, after extracting Basic-auth credentials and calling authenticationSystemSupport.finalizeAuthenticationTransaction, a null result means authentication could not be established for the supplied username. It is surfaced as BadRestRequestException: the credentials were present but the authentication transaction failed to produce a result.","triggerScenarios":"POST/PUT/DELETE to /v1/services with a valid-format Basic auth header whose username/password fail authentication; the configured REST authentication handler is unavailable or returns no handler result; authenticationSystemSupport returns null because no authentication transaction could be finalized for the synthetic service request.","commonSituations":"Wrong password in the automation script's -u option; the authentication backend (LDAP/REST source configured for management auth) is down or unreachable; credentials valid for CAS login but not for the management authentication policy; serviceFactory cannot create a service from the management request.","solutions":["Verify the Basic-auth username/password is correct and test it against the configured authentication source.","Check the logs of the underlying authentication handler for the real failure reason (bind failure, user not found, disabled account).","Confirm the authentication source used by the services REST endpoint is up and reachable.","Review authentication policy/requirements (e.g. required handler) that may reject the credential even if the password is correct."],"exampleFix":"// before\ncurl -u casadmin:wrongpass -X POST 'https://cas/v1/services' -d '{...}'\n// after\ncurl -u casadmin:correctpass -X POST 'https://cas/v1/services' -d '{...}'","handlingStrategy":"try-catch","validationCode":"// Verify credentials are non-empty and correctly Base64-encoded before sending\nObjects.requireNonNull(username, \"username\");\nObjects.requireNonNull(password, \"password\");\nString header = \"Basic \" + Base64.getEncoder().encodeToString((username + \":\" + password).getBytes(StandardCharsets.UTF_8));","typeGuard":null,"tryCatchPattern":"try { result = authenticateRequest(request); }\ncatch (BadRestRequestException e) {\n    logger.error(\"Authentication transaction failed for management API; check handler logs and credentials\");\n    return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(\"Management credentials rejected\");\n}","preventionTips":["Validate admin credentials against the backend auth source before deploying automation.","Monitor the authentication handler (LDAP/REST) health; outages surface as this error.","Confirm the username is permitted by the management authentication policy.","Log the actual handler failure from CAS logs rather than guessing from the 400 response."],"tags":["rest","cas","basic-auth","authentication-failed"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}