{"record":{"id":"5a2438d188a27595","repo":"apereo/cas","slug":"cannot-validate-authentication-for-login","errorCode":null,"errorMessage":"Cannot validate authentication for: [login]","messagePattern":"Cannot validate authentication for: \\[login\\]","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/authentication/InweboAuthenticationHandler.java","lineNumber":66,"sourceCode":"\n        val otp = inweboCredential.getOtp();\n        var authenticated = inweboCredential.isAlreadyAuthenticated();\n        var deviceName = inweboCredential.getDeviceName();\n        if (StringUtils.isNotBlank(otp)) {\n            val response = this.service.authenticateExtended(login, otp);\n            if (response.isOk()) {\n                authenticated = true;\n                deviceName = response.getDeviceName();\n            }\n        }\n\n        if (authenticated) {\n            inweboCredential.setDeviceName(deviceName);\n            LOGGER.info(\"Authenticated user: [{}] for device: [{}]\", login, deviceName);\n            val principal = this.principalFactory.createPrincipal(login);\n            return createHandlerResult(inweboCredential, principal);\n        }\n        throw new FailedLoginException(\"Cannot validate authentication for: \" + login);\n    }\n\n    @Override\n    public boolean supports(final Class<? extends Credential> clazz) {\n        return InweboCredential.class.isAssignableFrom(clazz);\n    }\n\n    @Override\n    public boolean supports(final Credential credential) {\n        return InweboCredential.class.isAssignableFrom(credential.getClass());\n    }\n}\n","sourceCodeStart":48,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/authentication/InweboAuthenticationHandler.java#L48-L79","documentation":"InweboAuthenticationHandler validates MFA credentials against the Inwebo service. If the remote service reports the push/OTP authentication as not authenticated, the handler throws FailedLoginException 'Cannot validate authentication for: <login>'. The cause is the Inwebo backend declining the transaction, not a local processing error.","triggerScenarios":"doAuthentication receives an InweboCredential for a login whose Inwebo authentication result is not 'authenticated' (denied push, wrong OTP, cancelled request, expired session).","commonSituations":"User declines or ignores the Inwebo push notification; user enters an incorrect OTP; device not enrolled or deactivated in the Inwebo console; Inwebo service API credentials valid but user locked/expired.","solutions":["Have the user approve the Inwebo push request or re-enter a correct OTP and retry","Verify the user's device is enrolled and active in the Inwebo administration console","Check the Inwebo service account/user status (not locked or expired)","Review Inwebo service logs for the transaction result to see why authentication was denied"],"exampleFix":"// before: user retries immediately after cancelling push (still denied)\n// after: trigger a new authentication so a fresh Inwebo push is sent\nreauthenticate with new InweboCredential","handlingStrategy":"try-catch","validationCode":"// precheck: user is enrolled and active in Inwebo before starting authentication\nboolean enrolled = inweboService.checkUserStatus(login) == UserStatus.ACTIVE;","typeGuard":null,"tryCatchPattern":"try {\n    return handler.authenticate(inweboCredential);\n} catch (FailedLoginException e) {\n    // prompt user to retry MFA approval / re-enter OTP\n}","preventionTips":["Confirm device enrollment before issuing MFA challenges","Set clear user-facing timeout/polling for push approvals","Monitor Inwebo service status and user lockouts"],"tags":["mfa","inwebo","authentication","failed-login"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}