{"record":{"id":"70eb73817ce5fbfa","repo":"apereo/cas","slug":"denied-s","errorCode":null,"errorMessage":"Denied: %s","messagePattern":"Denied: (.+?)","errorType":"exception","errorClass":"UnauthorizedSsoServiceException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/RegisteredServiceAuthenticationHandlerResolver.java","lineNumber":65,"sourceCode":"    @Override\n    public Set<AuthenticationHandler> resolve(final Set<AuthenticationHandler> candidateHandlers,\n                                              final AuthenticationTransaction transaction) throws Throwable {\n        val service = authenticationServiceSelectionPlan.resolveService(transaction.getService());\n        val registeredService = servicesManager.findServiceBy(service);\n\n        val requiredHandlers = filterRequiredAuthenticationHandlers(candidateHandlers, service, registeredService, transaction);\n        return filterExcludedAuthenticationHandlers(requiredHandlers, service, registeredService);\n    }\n\n    @Override\n    public boolean supports(final Set<AuthenticationHandler> handlers, final AuthenticationTransaction transaction) throws Throwable {\n        val service = authenticationServiceSelectionPlan.resolveService(transaction.getService());\n        if (service != null) {\n            val registeredService = servicesManager.findServiceBy(service);\n            LOGGER.trace(\"Located registered service definition [{}] for this authentication transaction\", registeredService);\n            if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n                LOGGER.warn(\"Service [{}] is not allowed to use SSO.\", service);\n                throw new UnauthorizedSsoServiceException(\"Denied: %s\".formatted(service));\n            }\n            val authenticationPolicy = registeredService.getAuthenticationPolicy();\n            return !authenticationPolicy.getRequiredAuthenticationHandlers().isEmpty()\n                   || !authenticationPolicy.getExcludedAuthenticationHandlers().isEmpty();\n        }\n        return false;\n    }\n\n    protected Set<AuthenticationHandler> filterExcludedAuthenticationHandlers(\n        final Set<AuthenticationHandler> candidateHandlers,\n        @Nullable final Service service,\n        @Nullable final RegisteredService registeredService) {\n\n        val authenticationPolicy = Objects.requireNonNull(registeredService).getAuthenticationPolicy();\n        val excludedHandlers = authenticationPolicy.getExcludedAuthenticationHandlers();\n        LOGGER.debug(\"Authentication transaction excludes [{}] for service [{}]\", excludedHandlers, service);\n\n        val handlerSet = new LinkedHashSet<>(candidateHandlers);","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/handler/RegisteredServiceAuthenticationHandlerResolver.java#L47-L83","documentation":"RegisteredServiceAuthenticationHandlerResolver.supports throws UnauthorizedSsoServiceException when the requested service is either not registered in the ServicesManager or its access strategy denies access. This blocks SSO participation for that service before any handler resolution happens. Note the thrown message also carries the deny reason from the access strategy in newer versions.","triggerScenarios":"A login/SSO request reaches handler resolution for a service whose findServiceBy(service) returns null, or whose RegisteredServiceAccessStrategy.isServiceAccessAllowed returns false (service disabled, expired, unauthorized delegation/SSO, or attribute-based rejection).","commonSituations":"Service not registered at all (no JSON/regex service registry entry); service definition disabled=true; service access strategy with snoozed expiration or enabled=false; case/scheme mismatch causing no registry match; attribute release policy denying the user.","solutions":["Register the service in the service registry (JSON file, etc.) so findServiceBy resolves it.","Fix the service definition's accessStrategy: set enabled=true, remove expiration, or adjust required attributes.","Verify the exact service URL (scheme, host, port, path) matches the registered pattern including case sensitivity.","If SSO should be disallowed but login allowed, configure unauthorizedSsoAuthenticationHandler behavior per policy instead of failing resolution.","Check the WARN log line 'is not allowed to use SSO' to identify which registered service (or null) was matched."],"exampleFix":"// before (JSON service def)\n\"@class\": \"org.apereo.cas.services.RegexRegisteredService\",\n\"serviceId\": \"^https://app.example.org/.*\",\n\"accessStrategy\": { \"@class\": \"...DefaultRegisteredServiceAccessStrategy\", \"enabled\": false }\n// after\n\"accessStrategy\": { \"@class\": \"...DefaultRegisteredServiceAccessStrategy\", \"enabled\": true, \"ssoEnabled\": true }","handlingStrategy":"validation","validationCode":"// before login, verify the service is registered and allowed\nvar service = authenticationServiceSelectionPlan.resolveService(context.getService());\nvar reg = servicesManager.findServiceBy(service);\nboolean ok = reg != null && reg.getAccessStrategy().isServiceAccessAllowed(reg, service);\nif (!ok) { throw new UnauthorizedSsoServiceException(\"Service not authorized: \" + service); }","typeGuard":null,"tryCatchPattern":"try {\n    return handlers.resolve(transaction);\n} catch (UnauthorizedSsoServiceException e) {\n    LOGGER.warn(\"Service denied SSO access: [{}]\", e.getMessage());\n    return buildUnauthorizedServiceErrorView(context);\n}","preventionTips":["Keep service registry entries reviewed: enabled=true, no expired access strategies.","Match serviceId patterns against the exact URLs clients actually send (scheme/host/port).","Automate service registry audits so stale/disabled definitions are caught before clients break."],"tags":["authentication","registered-service","sso","authorization"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}