{"record":{"id":"7d452fe1a8fe890d","repo":"apereo/cas","slug":"registered-service-access-is-not-allowed-for-servi","errorCode":null,"errorMessage":"Registered service access is not allowed for service definition for client id [{}]","messagePattern":"Registered service access is not allowed for service definition for client id \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20DeviceCodeResponseTypeRequestValidator.java","lineNumber":63,"sourceCode":"            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val grantType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.GRANT_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val validResponseType = OAuth20Utils.isResponseType(responseType, OAuth20ResponseTypes.DEVICE_CODE);\n        val validGrantType = OAuth20Utils.isGrantType(grantType, OAuth20GrantTypes.DEVICE_CODE);\n\n        if (!validResponseType && !validGrantType) {\n            LOGGER.warn(\"Response type [{}] or grant type [{}] is not supported.\", responseType, grantType);\n            return false;\n        }\n\n        val clientId = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.CLIENT_ID).orElse(StringUtils.EMPTY);\n        return FunctionUtils.doAndHandle(() -> {\n            val registeredService = Objects.requireNonNull(OAuth20Utils.getRegisteredOAuthServiceByClientId(this.servicesManager, clientId));\n            RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n            return (validResponseType && requestParameterResolver.isAuthorizedResponseTypeForService(context, registeredService))\n                   || (validGrantType && requestParameterResolver.isAuthorizedGrantTypeForService(context, registeredService));\n        }, t -> {\n            LOGGER.warn(\"Registered service access is not allowed for service definition for client id [{}]\", clientId);\n            return false;\n        }).get();\n    }\n\n    @Override\n    public boolean supports(final WebContext context) {\n        val responseType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.RESPONSE_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val grantType = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.GRANT_TYPE)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val clientId = requestParameterResolver.resolveRequestParameter(context, OAuth20Constants.CLIENT_ID)\n            .map(String::valueOf).orElse(StringUtils.EMPTY);\n        val validRequest = OAuth20Utils.isResponseType(responseType, OAuth20ResponseTypes.DEVICE_CODE)\n                           || OAuth20Utils.isGrantType(grantType, OAuth20GrantTypes.DEVICE_CODE);\n        return validRequest && StringUtils.isNotBlank(clientId);\n    }\n}\n","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20DeviceCodeResponseTypeRequestValidator.java#L45-L81","documentation":"OAuth20DeviceCodeResponseTypeRequestValidator.validate() rejects the device-authorization request when the registered OAuth service cannot be accessed or when neither the response type nor the grant type is authorized for the client. Any exception thrown by ensureServiceAccessIsAllowed (or the validator chain) is caught and converted into this warning and a `false` result, so the device code flow is denied early.","triggerScenarios":"A device-authorization request arrives with a clientId whose registered service is disabled, expired, outside its valid date window, or lacks access from the client's IP address; alternatively the service does not authorize the requested response type/grant type and neither `validResponseType` nor `validGrantType` evaluates true.","commonSituations":"Service definition created but left `enabled: false` or with an expiration date in the past; environment/IP allowlist restrictions on the service; supportedResponseTypes or supportedGrantTypes not configured on the service definition; wrong clientId sent by the device client.","solutions":["Inspect the registered service definition for the given clientId in the services registry (JSON/JDBC/etc.) and confirm the access strategy allows access (enabled, not expired, valid IP/environment).","Add the device-code response type and grant type to the service's supportedResponseTypes/supportedGrantTypes lists.","If access should be denied intentionally, no action: CAS correctly rejects it; fix the client to use a registered, authorized clientId.","Reload/redeploy the service registry after edits so ServicesManager picks up the new definition."],"exampleFix":"// before (service JSON)\n\"supportedGrantTypes\": [],\n\"supportedResponseTypes\": []\n// after\n\"supportedGrantTypes\": [\"urn:ietf:params:oauth:grant-type:device_code\"],\n\"supportedResponseTypes\": [\"device_token\"]","handlingStrategy":"validation","validationCode":"// before calling the device endpoint, verify service access in the registry\nconst svc = services.find(s => s.clientId === clientId);\nif (!svc || !svc.enabled || new Date(svc.expirationDate) < new Date()) {\n  throw new Error(`Service for clientId ${clientId} is not accessible`);\n}\nif (!svc.supportedGrantTypes.includes('urn:ietf:params:oauth:grant-type:device_code')) {\n  throw new Error('device_code grant not authorized for service');\n}","typeGuard":"function isAccessibleService(svc) {\n  return !!svc && svc.enabled === true &&\n    (!svc.expirationDate || new Date(svc.expirationDate) > new Date());\n}","tryCatchPattern":null,"preventionTips":["Always populate supportedGrantTypes and supportedResponseTypes on new service definitions","Keep service expiration dates current; use no-expiration for long-lived machine clients","Test device flow after every services-registry change"],"tags":["oauth","device-code-flow","access-denied","service-registry"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}