{"record":{"id":"7aef687a8d988445","repo":"apereo/cas","slug":"service-is-not-allowed-to-use-sso","errorCode":null,"errorMessage":"Service [{}] is not allowed to use SSO.","messagePattern":"Service \\[(.+?)\\] is not allowed to use SSO\\.","errorType":"exception","errorClass":"UnauthorizedSsoServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/authentication/DefaultSecurityTokenServiceTokenFetcher.java","lineNumber":42,"sourceCode":"@RequiredArgsConstructor\n@ToString(callSuper = true)\npublic class DefaultSecurityTokenServiceTokenFetcher implements SecurityTokenServiceTokenFetcher {\n    private final ServicesManager servicesManager;\n\n    private final AuthenticationServiceSelectionStrategy selectionStrategy;\n\n    private final CipherExecutor<String, String> credentialCipherExecutor;\n\n    private final SecurityTokenServiceClientBuilder clientBuilder;\n\n    @Override\n    public Optional<SecurityToken> fetch(final Service service, final String principalId) throws Throwable {\n        val resolvedService = selectionStrategy.resolveServiceFrom(service);\n        LOGGER.debug(\"Resolved service as [{}]\", resolvedService);\n        if (resolvedService != null) {\n            val rp = servicesManager.findServiceBy(resolvedService, WSFederationRegisteredService.class);\n            if (rp == null || !rp.getAccessStrategy().isServiceAccessAllowed(rp, service)) {\n                LOGGER.warn(\"Service [{}] is not allowed to use SSO.\", rp);\n                throw new UnauthorizedSsoServiceException();\n            }\n            LOGGER.debug(\"Building security token service client for registered service [{}]\", rp);\n            val sts = clientBuilder.buildClientForSecurityTokenRequests(rp);\n            return Optional.ofNullable(invokeSecurityTokenServiceForToken(rp, sts, principalId));\n        }\n        return Optional.empty();\n    }\n\n    private SecurityToken invokeSecurityTokenServiceForToken(final WSFederationRegisteredService rp,\n                                                             final SecurityTokenServiceClient sts,\n                                                             final String principalId) {\n\n        try {\n            val properties = sts.getProperties();\n            properties.put(SecurityConstants.USERNAME, principalId);\n            val uid = credentialCipherExecutor.encode(principalId);\n            properties.put(SecurityConstants.PASSWORD, uid);","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/authentication/DefaultSecurityTokenServiceTokenFetcher.java#L24-L60","documentation":"DefaultSecurityTokenServiceTokenFetcher resolved the service but ServicesManager returned no WSFederationRegisteredService, or the service's access strategy disallows SSO; in that case it logs this warning and throws UnauthorizedSsoServiceException. The relying party is not permitted to participate in single sign-on token issuance.","triggerScenarios":"fetch(service, principalId): servicesManager.findServiceBy(resolvedService, WSFederationRegisteredService.class) returns null, or rp.getAccessStrategy().isServiceAccessAllowed(rp, service) returns false.","commonSituations":"Service not registered in CAS (or registered as a plain service, not WS-Federation type); service disabled/unauthorized via access strategy (expired start/end date, blacklisted principal); selectionStrategy resolved an unexpected service; case/scheme mismatch in serviceId so nothing matched.","solutions":["Register the relying party as a WSFederationRegisteredService whose serviceId matches the requesting service URL","Enable SSO access on the service's access strategy (isServiceAccessAllowed) and check enabled/valid dates","Verify the resolved service id actually matches the registered service pattern (compare logged resolved id)","Reload/publish service registry changes so ServicesManager sees the updated definition"],"exampleFix":"// before (access strategy blocks SSO)\n\"accessStrategy\": { \"@class\": \"...DefaultRegisteredServiceAccessStrategy\", \"enabled\": true, \"ssoEnabled\": false }\n// after\n\"accessStrategy\": { \"@class\": \"...DefaultRegisteredServiceAccessStrategy\", \"enabled\": true, \"ssoEnabled\": true }","handlingStrategy":"validation","validationCode":"var rp = servicesManager.findServiceBy(service, WSFederationRegisteredService.class);\nif (rp == null || !rp.getAccessStrategy().isServiceAccessAllowed(rp, service)) { /* SSO token fetch will be denied */ }","typeGuard":null,"tryCatchPattern":"try { token = tokenFetcher.fetch(service, principalId); }\ncatch (UnauthorizedSsoServiceException e) { /* register/enable the service for SSO */ }","preventionTips":["Register every relying party as WSFederationRegisteredService with ssoEnabled=true","Keep service registry entries valid (dates, enabled flags)","Match serviceId patterns to the exact resolved service URLs"],"tags":["ws-federation","unauthorized-sso","service-registry","access-strategy"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}