{"record":{"id":"6696307237cf2a36","repo":"apereo/cas","slug":"the-authentication-request-is-not-recognized","errorCode":null,"errorMessage":"The authentication request is not recognized","messagePattern":"The authentication request is not recognized","errorType":"exception","errorClass":"UnauthorizedAuthenticationException","httpStatus":401,"severity":"error","filePath":"support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/WSFederationValidateRequestController.java","lineNumber":55,"sourceCode":"     *\n     * @param response the response\n     * @param request  the request\n     * @throws Exception the exception\n     */\n    @GetMapping(path = WSFederationConstants.ENDPOINT_FEDERATION_REQUEST)\n    @Operation(summary = \"Handle federation request\")\n    public void handleFederationRequest(final HttpServletResponse response,\n                                        final HttpServletRequest request) throws Exception {\n        val fedRequest = WSFederationRequest.of(request);\n        val wa = fedRequest.wa();\n        if (StringUtils.isBlank(wa)) {\n            throw new UnauthorizedAuthenticationException(\"Unable to determine the [WA] parameter\", new HashMap<>());\n        }\n\n        switch (wa.toLowerCase(Locale.ENGLISH)) {\n            case WSFederationConstants.WSIGNOUT10, WSFederationConstants.WSIGNOUT_CLEANUP10 -> handleLogoutRequest(fedRequest, request, response);\n            case WSFederationConstants.WSIGNIN10 -> handleInitialAuthenticationRequest(fedRequest, response, request);\n            default -> throw new UnauthorizedAuthenticationException(\"The authentication request is not recognized\", new HashMap<>());\n        }\n    }\n\n    protected void handleLogoutRequest(final WSFederationRequest fedRequest, final HttpServletRequest request,\n                                       final HttpServletResponse response) throws Exception {\n\n        val logoutUrl = FunctionUtils.doIf(StringUtils.isNotBlank(fedRequest.wreply()),\n                () -> {\n                    val service = createService(fedRequest);\n                    val registeredService = getWsFederationRegisteredService(service);\n                    LOGGER.debug(\"Invoking logout operation for request [{}], redirecting next to [{}] matched against [{}]\",\n                        fedRequest, fedRequest.wreply(), registeredService);\n                    val logoutParam = getConfigContext().getCasProperties().getLogout().getRedirectParameter().getFirst();\n                    return getConfigContext().getCasProperties().getServer().getLogoutUrl()\n                        .concat(\"?\").concat(logoutParam).concat(\"=\").concat(service.getId());\n                },\n                () -> getConfigContext().getCasProperties().getServer().getLogoutUrl())\n            .get();","sourceCodeStart":37,"sourceCodeEnd":73,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/WSFederationValidateRequestController.java#L37-L73","documentation":"After reading the `wa` parameter, the controller switches on its lowercase value against WS-Federation actions (wsignin1.0, wsignout1.0, wsignoutcleanup1.0). Any other value falls to the default branch and throws UnauthorizedAuthenticationException, because the requested action is not one CAS's WS-Federation IdP implements.","triggerScenarios":"A request reaches handleFederationRequest with a non-blank `wa` whose value (case-insensitively) is not exactly wsignin1.0, wsignout1.0, or wsignoutcleanup1.0.","commonSituations":"Typos like wsignin10 or wsign-in1.0 in hand-crafted URLs; a custom or newer WS-Fed action emitted by an unusual RP; an RP sending wauth or another parameter's value where wa is expected; URL-encoding corruption of the value.","solutions":["Correct the `wa` value on the relying party to one of wsignin1.0, wsignout1.0, or wsignoutcleanup1.0.","Log/inspect the incoming request URL at CAS to see the exact `wa` string received and compare with WSFederationConstants values.","Check that the RP is actually speaking WS-Federation (not SAML2 or OIDC) against this endpoint, and point other protocols at their proper CAS endpoints.","If a legitimately needed action is unsupported, extend the switch with a custom handler rather than reusing wsignin1.0 semantics."],"exampleFix":"// before (RP sends unrecognized action)\nGET /cas/ws-idp/federation?wa=wsignin10&wtrealm=myRealm\n// after\nGET /cas/ws-idp/federation?wa=wsignin1.0&wtrealm=myRealm","handlingStrategy":"validation","validationCode":"Set<String> allowed = Set.of(\"wsignin1.0\", \"wsignout1.0\", \"wsignoutcleanup1.0\");\nString wa = request.getParameter(\"wa\");\nif (wa == null || !allowed.contains(wa.toLowerCase(Locale.ENGLISH))) {\n    throw new IllegalArgumentException(\"Unsupported wa value: \" + wa);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only emit the exact action strings wsignin1.0/wsignout1.0/wsignoutcleanup1.0.","Capture the raw request URL when debugging to see what wa value actually arrived.","Confirm the RP is configured for WS-Federation, not another protocol, against this endpoint."],"tags":["ws-federation","http","invalid-parameter-value"],"backgroundTag":"invalid-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}