{"record":{"id":"6bf3b36b3da5240d","repo":"apereo/cas","slug":"caused-by","errorCode":null,"errorMessage":"[{}] Caused by: [{}]","messagePattern":"\\[(.+?)\\] Caused by: \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":401,"severity":"warning","filePath":"support/cas-server-support-rest-core/src/main/java/org/apereo/cas/support/rest/resources/RestResourceUtils.java","lineNumber":54,"sourceCode":"     * @param e                  the e\n     * @param request            the http request\n     * @param applicationContext the application context\n     * @return the response entity\n     */\n    public static ResponseEntity<String> createResponseEntityForAuthnFailure(final AuthenticationException e,\n                                                                             final HttpServletRequest request,\n                                                                             final ApplicationContext applicationContext) {\n        try {\n            val authnExceptions = e.getHandlerErrors().values()\n                .stream()\n                .map(ex -> mapExceptionToMessage(e, request, applicationContext, ex))\n                .collect(Collectors.toList());\n            if (authnExceptions.isEmpty()) {\n                authnExceptions.add(mapExceptionToMessage(e, request, applicationContext, e));\n            }\n            val errorsMap = new HashMap<String, List<String>>(1);\n            errorsMap.put(\"authentication_exceptions\", authnExceptions);\n            LOGGER.warn(\"[{}] Caused by: [{}]\", e.getMessage(), authnExceptions);\n\n            return new ResponseEntity<>(MAPPER.writerWithDefaultPrettyPrinter().writeValueAsString(errorsMap), HttpStatus.UNAUTHORIZED);\n        } catch (final JacksonException exception) {\n            LoggingUtils.error(LOGGER, e);\n            return new ResponseEntity<>(StringEscapeUtils.escapeHtml4(e.getMessage()), HttpStatus.INTERNAL_SERVER_ERROR);\n        }\n    }\n\n    private static String mapExceptionToMessage(final AuthenticationException authnhandlerErrors,\n                                                final HttpServletRequest request,\n                                                final ApplicationContext applicationContext,\n                                                final Throwable ex) {\n        val authnMsg = StringUtils.defaultIfBlank(StringEscapeUtils.escapeHtml4(ex.getMessage()),\n            \"Authentication Failure: \" + authnhandlerErrors.getMessage());\n        val authnBundleMsg = getTranslatedMessageForExceptionClass(ex.getClass().getSimpleName(), request, applicationContext);\n        return String.format(\"%s:%s\", authnMsg, authnBundleMsg);\n    }\n","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-rest-core/src/main/java/org/apereo/cas/support/rest/resources/RestResourceUtils.java#L36-L72","documentation":"RestResourceUtils.createResponseEntityForAuthnFailure converts a failed REST authentication attempt into a 401 UNAUTHORIZED response whose body lists authentication_exceptions and their cause messages. This warning logs the top-level exception plus its mapped causes. The error indicates the credentials supplied to the REST endpoint (e.g. /v1/tickets or REST protocol) failed authentication.","triggerScenarios":"POST to a CAS REST endpoint with Basic Auth or credentials body whose username/password do not validate against any configured authentication handler; credential extraction produced exceptions mapped into authnExceptions.","commonSituations":"Clients sending wrong/expired passwords to the REST ticket endpoint; service integrations using old service accounts; REST authentication handler misconfigured or backend (LDAP/JDBC) unreachable so authentication fails; encoding issues in the Authorization header.","solutions":["Verify the client is sending correct, current credentials (correct Basic Auth base64 encoding or properly form-encoded username/password).","Check the logged authnExceptions list in this warning to see the underlying handler failure (bad password vs. account locked vs. backend unreachable).","Confirm the relevant authentication handler is configured and reachable for REST authentication requests.","Fix or rotate the service account credentials on the client side; expect HTTP 401 until credentials validate."],"exampleFix":"// before: malformed client call\ncurl -u 'user:wrongpass' https://cas.example.org/cas/v1/tickets -d 'service=...'\n\n// after: correct credentials\ncurl -u 'user:correctpass' https://cas.example.org/cas/v1/tickets -d 'service=...'","handlingStrategy":"try-catch","validationCode":"if (credentials == null || !StringUtils.hasText(credentials.getUsername()) || !StringUtils.hasText(credentials.getPassword())) {\n    throw new BadCredentialsException(\"Username and password are required\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    ResponseEntity<String> resp = restTemplate.postForEntity(casTicketsUrl, request, String.class);\n} catch (HttpStatusCodeException e) {\n    if (e.getStatusCode() == HttpStatus.UNAUTHORIZED) {\n        // 401 body contains authentication_exceptions; rotate credentials and retry once\n    }\n}","preventionTips":["Store REST service-account credentials in a secret manager and rotate them.","Validate Basic Auth encoding on the client before sending.","Confirm authentication handler availability before bulk REST integrations."],"tags":["rest","authentication","http-401","credentials"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}