{"record":{"id":"4db15effa022caab","repo":"apereo/cas","slug":"passwordless-account-does-not-allow-delegated","errorCode":null,"errorMessage":"Passwordless account [{}] does not allow delegated authentication","messagePattern":"Passwordless account \\[(.+?)\\] does not allow delegated authentication","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java","lineNumber":51,"sourceCode":"        this.passwordlessUserAccountStore = passwordlessUserAccountStore;\n    }\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) throws Throwable {\n        val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n\n        if (!user.isAllowSelectionMenu()) {\n            LOGGER.error(\"Passwordless account [{}] is not allowed to select options\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n\n        val selection = extractSelectedAuthenticationOption(requestContext);\n        if (selection == PasswordlessSelectionMenu.PASSWORD && !doesPasswordlessAccountRequestPassword(user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not require a password\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.DELEGATION && !isDelegatedAuthenticationActiveFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow delegated authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        if (selection == PasswordlessSelectionMenu.MFA && !shouldActivateMultifactorAuthenticationFor(requestContext, user)) {\n            LOGGER.warn(\"Passwordless account [{}] does not allow multifactor authentication\", user.getUsername());\n            return buildErrorEvent(requestContext);\n        }\n        return buildFinalSelectionEvent(requestContext, selection);\n    }\n\n    protected Event buildFinalSelectionEvent(final RequestContext requestContext, final PasswordlessSelectionMenu selection) {\n        val finalEvent = switch (selection) {\n            case PASSWORD -> {\n                val user = Objects.requireNonNull(PasswordlessWebflowUtils.getPasswordlessAuthenticationAccount(requestContext, PasswordlessUserAccount.class));\n                WebUtils.putCasLoginFormViewable(requestContext, doesPasswordlessAccountRequestPassword(user));\n                yield CasWebflowConstants.TRANSITION_ID_PROMPT;\n            }\n            case TOKEN -> CasWebflowConstants.TRANSITION_ID_DISPLAY;\n            case MFA -> CasWebflowConstants.TRANSITION_ID_MFA;","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-passwordless-webflow/src/main/java/org/apereo/cas/web/flow/AcceptPasswordlessSelectionMenuAction.java#L33-L69","documentation":"AcceptPasswordlessSelectionMenuAction rejects the DELEGATION menu option when isDelegatedAuthenticationActiveFor is false for the user's account/request; CAS logs this warning and returns an error event. Delegated authentication is not available for this passwordless account.","triggerScenarios":"User selects DELEGATION in the passwordless selection menu while no delegated client is configured/authorized for that account (delegated auth not enabled for the service or the account's allowed options).","commonSituations":"pac4j delegation disabled or misconfigured; account store restricts the selection menu; service not authorized for delegated clients; user picks a stale option from a cached page.","solutions":["Verify delegated authentication is configured (cas.authn.pac4j.*) and active for the current service","Check the passwordless account's allowed selection options in the account store","Confirm isDelegatedAuthenticationActiveFor logic/customizations for this requestContext","Have the user select a supported option or reload the menu"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"if (selection == PasswordlessSelectionMenu.DELEGATION && delegatedClientsFor(service).isEmpty()) renderMenuAgain(account);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Enable pac4j delegation before offering the DELEGATION option","Scope menu options per service definition","Test the menu flow after each config change"],"tags":["passwordless","webflow","delegated-authentication"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}