{"record":{"id":"6ec1b648963b1e00","repo":"apereo/cas","slug":"security-token-ticket-is-not-found-or-has-exp","errorCode":null,"errorMessage":"Security token ticket [{}] is not found or has expired","messagePattern":"Security token ticket \\[(.+?)\\] is not found or has expired","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java","lineNumber":85,"sourceCode":"    /**\n     * Gets security token from request.\n     *\n     * @param request the request\n     * @return the security token from request\n     */\n    protected SecurityToken getSecurityTokenFromRequest(final HttpServletRequest request) {\n        val cookieValue = configContext.getTicketGrantingTicketCookieGenerator().retrieveCookieValue(request);\n        if (StringUtils.isNotBlank(cookieValue)) {\n            val tgt = configContext.getTicketRegistry().getTicket(cookieValue, TicketGrantingTicket.class);\n            if (tgt != null) {\n                val sts = tgt.getDescendantTickets().stream()\n                    .filter(t -> t.startsWith(SecurityTokenTicket.PREFIX))\n                    .findFirst()\n                    .orElse(null);\n                if (StringUtils.isNotBlank(sts)) {\n                    val stt = configContext.getTicketRegistry().getTicket(sts, SecurityTokenTicket.class);\n                    if (stt == null || stt.isExpired()) {\n                        LOGGER.warn(\"Security token ticket [{}] is not found or has expired\", sts);\n                        return null;\n                    }\n                    if (stt.getSecurityToken() == null || stt.getSecurityToken().isExpired()) {\n                        LOGGER.warn(\"Security token linked to ticket [{}] has expired\", sts);\n                        return null;\n                    }\n                    return stt.getSecurityToken();\n                }\n            }\n        }\n        return null;\n    }\n\n\n    protected boolean shouldRenewAuthentication(final WSFederationRequest fedRequest,\n                                                final HttpServletRequest request) {\n        if (StringUtils.isBlank(fedRequest.wfresh()) || !NumberUtils.isCreatable(fedRequest.wfresh())) {\n            return false;","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java#L67-L103","documentation":"The WS-Federation IdP controller looks up the security-token ticket (RST/wresult reference prefixed with the SecurityTokenTicket prefix) in the ticket registry; if the ticket is absent or expired the controller returns null and the token cannot be obtained. This is a warn log, not an exception.","triggerScenarios":"getSecurityTokenFromRequest() extracts a wctx/ticket id starting with SecurityTokenTicket.PREFIX, calls ticketRegistry.getTicket(sts, SecurityTokenTicket.class), and gets null or an expired ticket.","commonSituations":"Long-running browser flow exceeded the security-token-ticket expiration time; ticket registry (e.g. clustered Redis/Memcached) lost the ticket or nodes point at different stores; user replayed an old bookmarked URL; ticket cleanup ran between request steps.","solutions":["Raise the security token ticket expiration (cas.authn.wsfed-idp ticket time-to-kill) to cover your flow length","Ensure all CAS nodes share the same ticket registry backend","Have the user restart the sign-in flow instead of replaying stale URLs","Enable ticket-registry logging to check whether the ticket was evicted or expired"],"exampleFix":"// before (default short TTL)\ncas.authn.wsfed-idp.security-token-tickets.time-to-kill-in-seconds=60\n// after\ncas.authn.wsfed-idp.security-token-tickets.time-to-kill-in-seconds=600","handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if (token == null) { /* restart the WS-Federation flow to obtain a fresh ticket */ }","preventionTips":["Set security-token-ticket TTL larger than the expected flow duration","Share one ticket registry across all CAS nodes","Avoid bookmarking/replaying federation callback URLs"],"tags":["ws-federation","ticket-expired","ticket-registry"],"backgroundTag":"jwt-token-expired","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}