{"record":{"id":"526f7a93aa5670bf","repo":"apereo/cas","slug":"authentication-request-was-denied-from-the-provide","errorCode":null,"errorMessage":"Authentication request was denied from the provider %s","messagePattern":"Authentication request was denied from the provider (.+?)","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationStoreWebflowStateAction.java","lineNumber":82,"sourceCode":"                    .findFirst()\n                    .map(IndirectClient.class::cast)\n                    .stream()\n                    .peek(InitializableObject::init)\n                    .findFirst()\n                    .map(Unchecked.function(client -> {\n                        val ticket = delegatedClientAuthenticationWebflowManager.store(requestContext, webContext, client);\n                        requestContext.getFlowScope().put(TransientSessionTicket.class.getName(), ticket);\n                        return ticket;\n                    }))\n                    .map(ticket -> eventFactory.event(this,\n                        CasWebflowConstants.TRANSITION_ID_REDIRECT, ticket.getClass().getName(), ticket))\n                    .stream()\n                    .findFirst()\n                    .orElseThrow(() -> UnauthorizedServiceException.denied(\"Unable to locate client identity provider %s\".formatted(clientName))),\n                throwable -> {\n                    val message = String.format(\"Authentication request was denied from the provider %s\", clientName);\n                    LoggingUtils.warn(LOGGER, message, throwable);\n                    throw UnauthorizedServiceException.wrap(throwable);\n                })\n            .get();\n    }\n\n    protected boolean isDelegatedClientAuthorizedForService(final Client client,\n                                                            @Nullable final Service service,\n                                                            final RequestContext requestContext) {\n        return configContext.getDelegatedClientIdentityProviderAuthorizers()\n            .stream()\n            .allMatch(Unchecked.predicate(authz -> authz.isDelegatedClientAuthorizedForService(client, service, requestContext)));\n    }\n\n}\n","sourceCodeStart":64,"sourceCodeEnd":96,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationStoreWebflowStateAction.java#L64-L96","documentation":"When resolving the delegated identity provider in DelegatedClientAuthenticationStoreWebflowStateAction, the provider lookup or authorization call throws; CAS converts that throwable into an UnauthorizedServiceException stating the authentication request was denied from the provider. It signals the provider exists in config but rejected/refused this authentication attempt.","triggerScenarios":"isDelegatedClientAuthorizedForService (or a downstream pac4j call) throws while processing provider clientName during webflow state storage; the exception path via FunctionUtils.wrap wraps the throwable.","commonSituations":"Client not authorized for the requested service (regex/attribute filter mismatch); provider redirect failed mid-flow; user denied consent at the IdP and the error propagated back.","solutions":["Check the delegated client's authorized services/attribute rules in cas.authn.pac4j.* for the calling service","Inspect the wrapped throwable (logged as a warning by LoggingUtils) for the root cause","Verify the service definition allows delegated authentication for this provider","Test the provider independently (valid clientId/secret, reachable discovery endpoint)"],"exampleFix":"// before\n@JsonSerialize... // service filter excludes provider\n\"clientId\": \"abc\", \"allowedProviders\": [\"Cas\"]\n// after\n\"allowedProviders\": [\"Cas\", \"SAML2-IdP\"],","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { storeState(...) } catch (UnauthorizedServiceException e) { renderDelegationDeniedPage(e); }","preventionTips":["Configure allowedProviders per service explicitly","Log and review wrapped root-cause throwables","Test each IdP end-to-end after config changes"],"tags":["sso","delegated-authentication","pac4j","service-authorization"],"backgroundTag":"http-error-response","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}