{"record":{"id":"7ea4c27e8bbb3d8b","repo":"apereo/cas","slug":"client-is-rejected-for-authentication-based-o","errorCode":null,"errorMessage":"Client [{}] is rejected for authentication based on country location","messagePattern":"Client \\[(.+?)\\] is rejected for authentication based on country location","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java","lineNumber":58,"sourceCode":"        }\n        val clientIp = clientInfo.getClientIpAddress();\n        if (isIpAddressRejected(requestContext, clientIp)) {\n            LOGGER.warn(\"Client IP [{}] is rejected for authentication\", clientIp);\n            return false;\n        }\n\n        if (isUserAgentRejected(userAgent)) {\n            LOGGER.warn(\"User agent [{}] is rejected for authentication\", userAgent);\n            return false;\n        }\n        LOGGER.debug(\"User agent [{}] is authorized to proceed\", userAgent);\n        if (this.geoLocationService != null && location != null && StringUtils.isNotBlank(clientIp)\n            && StringUtils.isNotBlank(this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries())) {\n            val loc = this.geoLocationService.locate(clientIp, location);\n            if (loc != null) {\n                LOGGER.debug(\"Determined geolocation for [{}] to be [{}]\", clientIp, loc);\n                if (isGeoLocationCountryRejected(loc)) {\n                    LOGGER.warn(\"Client [{}] is rejected for authentication based on country location\", clientIp);\n                    return false;\n                }\n            } else {\n                LOGGER.info(\"Could not determine geolocation for [{}]\", clientIp);\n            }\n        }\n        LOGGER.debug(\"Adaptive authentication policy has authorized client [{}] to proceed.\", clientIp);\n        return true;\n    }\n\n    private boolean isGeoLocationCountryRejected(final GeoLocationResponse finalLoc) {\n        val rejectCountries = this.adaptiveAuthenticationProperties.getPolicy().getRejectCountries();\n        return StringUtils.isNotBlank(rejectCountries)\n               && RegexUtils.find(rejectCountries, finalLoc.build());\n    }\n\n    private boolean isUserAgentRejected(final String userAgent) {\n        val rejectBrowsers = this.adaptiveAuthenticationProperties.getPolicy().getRejectBrowsers();","sourceCodeStart":40,"sourceCodeEnd":76,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/DefaultAdaptiveAuthenticationPolicy.java#L40-L76","documentation":"DefaultAdaptiveAuthenticationPolicy rejects an authentication request because the client's resolved geolocation country appears in cas.authn.adaptive.policy.reject-countries. This is a WARN log plus a 'false' return from isAuthenticationRequestAllowed, which the adaptive policy engine turns into an authentication block. It means geo-location data matched a deliberately configured blacklist.","triggerScenarios":"Authentication attempt whose client IP resolves via geoLocationService.locate() to a country listed in adaptiveAuthenticationProperties.getPolicy().getRejectCountries().","commonSituations":"Users behind VPNs/proxies exiting in a blocked country; misconfigured reject-countries list accidentally including the users' own country; stale or wrong GeoLite2 database attributing the wrong country; server-side NAT making all clients appear from one region.","solutions":["Remove the client's country from cas.authn.adaptive.policy.reject-countries, or have the user disable their VPN/proxy","Verify the geoIP database (MaxMind) is current and correctly located; update or fix cas.geo-location settings","If blanket country blocking is unintended, remove/reduce the reject-countries entry or disable the adaptive policy feature"],"exampleFix":"// before\ncas.authn.adaptive.policy.reject-countries=DE,FR\n// after\ncas.authn.adaptive.policy.reject-countries=","handlingStrategy":"validation","validationCode":"if (policy != null && policy.getRejectCountries() != null && geoService.locate(clientIp, null) != null) { /* check country not in rejectCountries before calling */ }","typeGuard":"boolean isCountryAllowed(GeoLocationService svc, String ip, List<String> rejected) { var loc = svc.locate(ip, null); return loc == null || rejected == null || !rejected.contains(loc.getCountry()); }","tryCatchPattern":null,"preventionTips":["Keep reject-countries minimal and review after geoIP database updates","Test authentication from representative IPs/VPN exits before deploying","Pin and regularly refresh the MaxMind database"],"tags":["adaptive-authentication","geoip","access-denied","security-policy"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}