{"record":{"id":"742298c629defb2c","repo":"apereo/cas","slug":"client-ip-is-banned","errorCode":null,"errorMessage":"Client IP [{}] is banned","messagePattern":"Client IP \\[(.+?)\\] is banned","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java","lineNumber":85,"sourceCode":"    }\n\n    private boolean isGeoLocationCountryRejected(final GeoLocationResponse finalLoc) {\n        val rejectCountries = this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries();\n        return StringUtils.isNotBlank(rejectCountries)\n               && RegexUtils.find(rejectCountries, finalLoc.build());\n    }\n\n    private boolean isUserAgentRejected(final String userAgent) {\n        val rejectBrowsers = this.adaptiveAuthenticationProperties.getPolicy().getRejectBrowsers();\n        return StringUtils.isNotBlank(rejectBrowsers)\n               && RegexUtils.find(rejectBrowsers, userAgent);\n    }\n\n    private boolean isIpAddressRejected(final RequestContext requestContext, final String clientIp) throws Throwable {\n        LOGGER.trace(\"Located client IP address as [{}]\", clientIp);\n        val ipResult = ipAddressIntelligenceService.examine(requestContext, clientIp);\n        if (ipResult == null || ipResult.isBanned()) {\n            LOGGER.warn(\"Client IP [{}] is banned\", clientIp);\n            return true;\n        }\n        if (ipResult.isRanked()) {\n            val threshold = adaptiveAuthenticationProperties.getRisk().getCore().getThreshold();\n            if (ipResult.getScore() >= threshold) {\n                LOGGER.warn(\"Client IP [{}] is rejected for authentication because intelligence score [{}] is higher than the configured risk threshold [{}]\",\n                    clientIp, ipResult.getScore(), threshold);\n                return true;\n            }\n        }\n        return false;\n    }\n}\n","sourceCodeStart":67,"sourceCodeEnd":99,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java#L67-L99","documentation":"isIpAddressRejected consults the configured ipAddressIntelligenceService; if it returns null or a result flagged isBanned(), the client IP is treated as banned and authentication is refused with this warning. It is a deliberate IP-reputation-based block, not an internal failure.","triggerScenarios":"ipAddressIntelligenceService.examine(requestContext, clientIp) returns null, or returns an IPIntelligenceResult whose isBanned() is true, during isAuthenticationRequestAllowed.","commonSituations":"Client IP on a threat-intel blacklist (botnet, proxy, Tor exit node); shared corporate/NAT IP with bad reputation; misconfigured IP intelligence service returning null for every address; risk-service outage producing null results conservatively interpreted as banned.","solutions":["Have the client disconnect from VPN/proxy or obtain a different IP","Whitelist the IP or adjust the IP intelligence service configuration so the address is no longer banned","Check why the service returns null (connectivity/auth to the risk API); a null result is conservatively treated as banned"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"IPIntelligenceResult r = ipIntel.examine(ctx, ip); if (r == null || r.isBanned()) { /* route to support / use different network */ }","typeGuard":"boolean isIpAllowed(IPAddressIntelligenceService svc, RequestContext ctx, String ip) { var r = svc.examine(ctx, ip); return r != null && !r.isBanned(); }","tryCatchPattern":null,"preventionTips":["Monitor the IP intelligence service health so null results are rare","Document a whitelist process for shared NAT IPs","Alert users about VPN/proxy restrictions"],"tags":["ip-reputation","banned-ip","adaptive-authentication","access-denied"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}