{"record":{"id":"689d115565fb322c","repo":"apereo/cas","slug":"service-is-not-authorized","errorCode":null,"errorMessage":"Service [{}] is not authorized","messagePattern":"Service \\[(.+?)\\] is not authorized","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"core/cas-server-core-web-api/src/main/java/org/apereo/cas/services/web/support/RegisteredServiceResponseHeadersEnforcementFilter.java","lineNumber":95,"sourceCode":"            return Optional.empty();\n        }\n        \n        val service = argumentExtractor.getObject().extractService(httpServletRequest);\n        if (service != null) {\n            LOGGER.trace(\"Attempting to resolve service for [{}]\", service);\n            val resolved = authenticationRequestServiceSelectionStrategies.getObject().resolveService(service);\n            val servicesManager = servicesManagerProvider.getObject();\n            val registeredService = NumberUtils.isCreatable(resolved.getId())\n                ? servicesManager.findServiceBy(Long.parseLong(resolved.getId()))\n                : servicesManager.findServiceBy(resolved);\n            val audit = AuditableContext\n                .builder()\n                .registeredService(registeredService)\n                .service(service)\n                .build();\n            val accessResult = registeredServiceAccessStrategyEnforcer.getObject().execute(audit);\n            if (accessResult.isExecutionFailure()) {\n                LOGGER.warn(\"Service [{}] is not authorized\", resolved);\n                httpServletResponse.setStatus(HttpStatus.FORBIDDEN.value());\n                httpServletRequest.setAttribute(RequestDispatcher.ERROR_EXCEPTION, accessResult.getException().orElse(null));\n                return Optional.empty();\n            }\n            return Optional.of(registeredService);\n        }\n        return Optional.empty();\n    }\n    @Override\n    protected void decideInsertContentSecurityPolicyHeader(final HttpServletResponse httpServletResponse,\n                                                           final HttpServletRequest httpServletRequest,\n                                                           final Optional<RegisteredService> result) {\n\n        val shouldInject = shouldHttpHeaderBeInjectedIntoResponse(result,\n            RegisteredServiceProperties.HTTP_HEADER_ENABLE_CONTENT_SECURITY_POLICY);\n\n        if (shouldInject.isPresent()) {\n            if (shouldInject.get()) {","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-web-api/src/main/java/org/apereo/cas/services/web/support/RegisteredServiceResponseHeadersEnforcementFilter.java#L77-L113","documentation":"RegisteredServiceResponseHeadersEnforcementFilter.prepareFilterBeforeExecution logs 'Service [x] is not authorized' when the registered service access strategy enforcer reports an execution failure. The filter then responds HTTP 403 FORBIDDEN, stores the access exception as a request attribute, and skips adding the service's enforced response headers.","triggerScenarios":"An incoming request matches a registered service, but RegisteredServiceAccessStrategyEnforcer.execute denies access — e.g. service disabled/unauthorized, access strategy case-sensitive name mismatch, unauthorized email/domain, missing required attributes, or time/day restrictions in the service definition.","commonSituations":"Service registry entry disabled or expired; attribute-based release policy denies the current principal; the service URL pattern matches but access strategy rules (delegated policy, LDAP-backed policy) fail; environment where the enforcer bean throws (upstream exceptions surfaced via accessResult.getException()).","solutions":["Inspect the request attribute ERROR_EXCEPTION / logs for the underlying access strategy exception to learn the denial reason.","Fix the registered service definition: enable it, correct the service URL/pattern, or update the access strategy (authorized users, attributes, time window).","Verify attribute release/attribute repository sources so required attributes are available at enforcement time.","If the service should not be governed by this filter, adjust the filter/exclusion configuration rather than the service policy.","Confirm the CAS node can reach backing stores (LDAP/Groovy policy) — unreachable sources can cause execution failure."],"exampleFix":"// before: service JSON denies access\n\"accessStrategy\": { \"@class\": \"DefaultRegisteredServiceAccessStrategy\", \"enabled\": false }\n// after\n\"accessStrategy\": { \"@class\": \"DefaultRegisteredServiceAccessStrategy\", \"enabled\": true, \"ssoEnabled\": true }","handlingStrategy":"try-catch","validationCode":"// Pre-check access before relying on response headers:\nvar audit = RegisteredServiceAccessStrategyAudit.builder()\n    .registeredService(registeredService).service(service).build();\nif (accessEnforcer.execute(audit).isExecutionFailure()) {\n    LOGGER.warn(\"Service {} will be denied; fix access strategy\", service.getId());\n}","typeGuard":"boolean isServiceAccessible(RegisteredService svc, Principal p) {\n    return svc.getAccessStrategy().isServiceAccessAllowed(svc, p);\n}","tryCatchPattern":null,"preventionTips":["Audit registered services' accessStrategy settings (enabled, ssoEnabled, caseInsensitive, required attributes).","Test service definitions in lower environments before promoting them to the registry.","Log/inspect the exception stored in RequestDispatcher.ERROR_EXCEPTION for the denial root cause.","Ensure backing attribute/policy stores (LDAP, Groovy, REST) are reachable at request time."],"tags":["authorization","http-403","service-management"],"backgroundTag":"insufficient-permissions","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}