{"record":{"id":"5cf570b8070ec53a","repo":"apereo/cas","slug":"authentication-pre-processor-has-failed-to-process","errorCode":null,"errorMessage":"Authentication pre-processor has failed to process transaction","messagePattern":"Authentication pre-processor has failed to process transaction","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java","lineNumber":64,"sourceCode":"\n    private final AuthenticationEventExecutionPlan authenticationEventExecutionPlan;\n\n    private final ObjectProvider<AuthenticationSystemSupport> authenticationSystemSupport;\n\n    private final boolean principalResolutionFailureFatal;\n\n    private final ConfigurableApplicationContext applicationContext;\n\n    @Override\n    @Audit(\n        action = AuditableActions.AUTHENTICATION,\n        actionResolverName = AuditActionResolvers.AUTHENTICATION_RESOLVER,\n        resourceResolverName = AuditResourceResolvers.AUTHENTICATION_RESOURCE_RESOLVER)\n    public Authentication authenticate(final AuthenticationTransaction transaction) throws Throwable {\n        val result = invokeAuthenticationPreProcessors(transaction);\n        if (!result) {\n            LOGGER.warn(\"An authentication pre-processor could not successfully process the authentication transaction\");\n            throw new AuthenticationException(\"Authentication pre-processor has failed to process transaction\");\n        }\n        val authenticationBuilder = authenticateInternal(transaction);\n        val authentication = authenticationBuilder.build();\n        addAuthenticationMethodAttribute(authenticationBuilder, authentication);\n        populateAuthenticationMetadataAttributes(authenticationBuilder, transaction);\n        invokeAuthenticationPostProcessors(authenticationBuilder, transaction);\n\n        val auth = authenticationBuilder.build();\n        val principal = auth.getPrincipal();\n        if (principal instanceof NullPrincipal) {\n            throw new UnresolvedPrincipalException(auth);\n        }\n        LOGGER.info(\"Authenticated principal [{}] with attributes [{}] via credentials [{}].\",\n            principal.getId(), principal.getAttributes(), transaction.getCredentials());\n        return auth;\n    }\n\n    protected void invokeAuthenticationPostProcessors(final AuthenticationBuilder builder,","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java#L46-L82","documentation":"DefaultAuthenticationManager.authenticate throws AuthenticationException when any registered AuthenticationPreProcessor returns false from processAuthenticationTransaction, meaning a pre-processor vetoed the transaction before any handler ran.","triggerScenarios":"A custom or built-in AuthenticationPreProcessor (e.g. credential caching, risk-aware or MFA pre-processing) evaluates the transaction and returns false; authenticate() then aborts with this message and logs a warning naming pre-processor failure.","commonSituations":"Custom pre-processor plugins misbehaving (e.g. failure to reach a risk service, corrupted cache) returning false; ordering issues where a pre-processor runs before required state exists; configuration enabling a pre-processor whose backing service is down.","solutions":["Check CAS logs for the preceding warning to identify which pre-processor failed","Review/disable the offending AuthenticationPreProcessor bean or its backing service","Fix the root cause inside the custom pre-processor (connection, cache, configuration) so it returns true","Remove the pre-processor registration if it is not needed for your deployment"],"exampleFix":"// before\npublic boolean processAuthenticationTransaction(AuthenticationTransaction t) { return riskService.check(t); } // service down -> false\n// after\npublic boolean processAuthenticationTransaction(AuthenticationTransaction t) {\n    try { return riskService.check(t); } catch (Exception e) { LOGGER.warn(\"Risk check unavailable; allowing\", e); return true; }\n}","handlingStrategy":"try-catch","validationCode":"// check pre-processors before authenticate\nboolean allHealthy = authenticationPreProcessors.stream()\n    .allMatch(p -> p.isHealthy != null ? p.isHealthy() : true);","typeGuard":null,"tryCatchPattern":"try {\n    Authentication auth = authenticationManager.authenticate(transaction);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"pre-processor has failed\")) {\n        LOGGER.error(\"Identify failing AuthenticationPreProcessor from preceding WARN log\");\n    }\n}","preventionTips":["Audit custom AuthenticationPreProcessor implementations for false returns","Make pre-processors fault-tolerant when their backing services are unavailable","Monitor the pre-processor dependencies (caches, risk services) for health"],"tags":["java","authentication","pre-processor"],"backgroundTag":"api-error-response","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}