{"record":{"id":"7916dad087f845ca","repo":"apereo/cas","slug":"realm-is-not-authorized-for-matching-service","errorCode":null,"errorMessage":"Realm [{}] is not authorized for matching service [{}]","messagePattern":"Realm \\[(.+?)\\] is not authorized for matching service \\[(.+?)\\]","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java","lineNumber":130,"sourceCode":"            return true;\n        }\n\n        val ttlMs = TimeUnit.MINUTES.toMillis(ttl);\n        if (ttlMs > 0) {\n            val createdDate = idpToken.getCreated();\n            if (createdDate != null) {\n                val expiryDate = new Date(createdDate.toEpochMilli() + ttlMs);\n                return expiryDate.before(new Date());\n            }\n        }\n        return false;\n    }\n\n    protected WSFederationRegisteredService findAndValidateFederationRequestForRegisteredService(final Service targetService,\n                                                                                                 final WSFederationRequest fedRequest) {\n        val svc = getWsFederationRegisteredService(targetService);\n        if (StringUtils.isBlank(fedRequest.wtrealm()) || !Strings.CI.equals(fedRequest.wtrealm(), svc.getRealm())) {\n            LOGGER.warn(\"Realm [{}] is not authorized for matching service [{}]\", fedRequest.wtrealm(), svc);\n            throw UnauthorizedServiceException.denied(\"Rejected: %s\".formatted(svc.getRealm()));\n        }\n        val idp = configContext.getCasProperties().getAuthn().getWsfedIdp().getIdp();\n        if (!Strings.CI.equals(idp.getRealm(), svc.getRealm())) {\n            LOGGER.warn(\"Realm [{}] is not authorized for the identity provider realm [{}]\", fedRequest.wtrealm(), idp.getRealm());\n            throw UnauthorizedServiceException.denied(\"Rejected: %s\".formatted(svc.getRealm()));\n        }\n\n        return svc;\n    }\n\n    protected WSFederationRegisteredService getWsFederationRegisteredService(final Service targetService) {\n        val svc = configContext.getServicesManager().findServiceBy(targetService, WSFederationRegisteredService.class);\n        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(targetService, svc);\n        return svc;\n    }\n\n    /**","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp/src/main/java/org/apereo/cas/ws/idp/web/BaseWSFederationRequestController.java#L112-L148","documentation":"The wtrealm value presented in the WS-Federation request is blank or does not (case-insensitively) match the realm configured on the matching WSFederationRegisteredService, so the request is rejected with UnauthorizedServiceException.denied().","triggerScenarios":"findAndValidateFederationRequestForRegisteredService() compares fedRequest.wtrealm() against svc.getRealm() via Strings.CI.equals and fails, then throws UnauthorizedServiceException.","commonSituations":"Application's wtrealm/Realm query parameter differs from the realm set on the CAS registered service (trailing slash, http vs https host, case handled only loosely); service resolution matched a different/wrong registered service; app upgraded and changed its realm identifier.","solutions":["Set the registered service's realm to exactly the wtrealm the application sends (or fix the app's wtrealm)","Compare the logged realm and service values for whitespace/scheme/path differences and correct them","Verify service matching resolves the intended WSFederationRegisteredService (serviceId pattern not too greedy)","Re-test with a fresh sign-in request after fixing the realm"],"exampleFix":"// before\n\"realm\": \"https://app.example.com/\"  (app sends https://app.example.com)\n// after\n\"realm\": \"https://app.example.com\"","handlingStrategy":"validation","validationCode":"if (fedRequest.wtrealm() == null || !fedRequest.wtrealm().equalsIgnoreCase(registeredService.getRealm())) {\n    throw new IllegalArgumentException(\"wtrealm does not match registered service realm\");\n}","typeGuard":null,"tryCatchPattern":"try { controller.findAndValidateFederationRequestForRegisteredService(service, request); }\ncatch (UnauthorizedServiceException e) { /* inspect realm config of app and CAS service */ }","preventionTips":["Copy the exact wtrealm from the application's federation request into the registered service","Avoid scheme/trailing-slash differences between app and service realm","Verify service-matching patterns resolve the intended service"],"tags":["ws-federation","unauthorized-service","realm-mismatch"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}