{"record":{"id":"54c0fc1c091c6a6b","repo":"apereo/cas","slug":"realm-is-not-authorized-for-the-identity-prov","errorCode":null,"errorMessage":"Realm [{}] is not authorized for the identity provider realm [{}]","messagePattern":"Realm \\[(.+?)\\] is not authorized for the identity provider realm \\[(.+?)\\]","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java","lineNumber":135,"sourceCode":"            val createdDate = idpToken.getCreated();\n            if (createdDate != null) {\n                val expiryDate = new Date(createdDate.toEpochMilli() + ttlMs);\n                return expiryDate.before(new Date());\n            }\n        }\n        return false;\n    }\n\n    protected WSFederationRegisteredService findAndValidateFederationRequestForRegisteredService(final Service targetService,\n                                                                                                 final WSFederationRequest fedRequest) {\n        val svc = getWsFederationRegisteredService(targetService);\n        if (StringUtils.isBlank(fedRequest.wtrealm()) || !Strings.CI.equals(fedRequest.wtrealm(), svc.getRealm())) {\n            LOGGER.warn(\"Realm [{}] is not authorized for matching service [{}]\", fedRequest.wtrealm(), svc);\n            throw UnauthorizedServiceException.denied(\"Rejected: %s\".formatted(svc.getRealm()));\n        }\n        val idp = configContext.getCasProperties().getAuthn().getWsfedIdp().getIdp();\n        if (!Strings.CI.equals(idp.getRealm(), svc.getRealm())) {\n            LOGGER.warn(\"Realm [{}] is not authorized for the identity provider realm [{}]\", fedRequest.wtrealm(), idp.getRealm());\n            throw UnauthorizedServiceException.denied(\"Rejected: %s\".formatted(svc.getRealm()));\n        }\n\n        return svc;\n    }\n\n    protected WSFederationRegisteredService getWsFederationRegisteredService(final Service targetService) {\n        val svc = configContext.getServicesManager().findServiceBy(targetService, WSFederationRegisteredService.class);\n        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(targetService, svc);\n        return svc;\n    }\n\n    /**\n     * Handle unauthorized service exception.\n     *\n     * @param req the req\n     * @param ex  the ex\n     * @return the model and view","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java#L117-L153","documentation":"The realm of the registered WS-Federation service does not match the identity provider's own configured realm (cas.authn.wsfed-idp.idp.realm), so the federation request is rejected with UnauthorizedServiceException.denied(). This is an IdP-wide configuration mismatch, distinct from the per-request wtrealm check.","triggerScenarios":"findAndValidateFederationRequestForRegisteredService(): after the wtrealm check passes, Strings.CI.equals(idp.getRealm(), svc.getRealm()) is false and UnauthorizedServiceException is thrown.","commonSituations":"CAS IdP realm property changed or mis-typed during migration; services were created against a different IdP realm (e.g. staging vs production host); copy-pasted service definitions from another CAS environment.","solutions":["Align cas.authn.wsfed-idp.idp.realm with the realm on all WS-Federation registered services","Update the affected registered service definitions' realm to the IdP realm","Re-check config after environment promotion so IdP and services use matching realms"],"exampleFix":"// before\ncas.authn.wsfed-idp.idp.realm=https://old-idp.example.com\n// after\ncas.authn.wsfed-idp.idp.realm=https://idp.example.com","handlingStrategy":"validation","validationCode":"if (!idpRealm.equalsIgnoreCase(service.getRealm())) throw new IllegalStateException(\"Service realm must equal IdP realm: \" + idpRealm);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep cas.authn.wsfed-idp.idp.realm and service realms in a shared config source per environment","Run a startup check that all WS-Federation services match the IdP realm","Update service definitions whenever the IdP realm changes"],"tags":["ws-federation","realm-mismatch","unauthorized-service"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}