{"record":{"id":"98469b3f5346f5f9","repo":"apereo/cas","slug":"aborting-since-denyrevocationpolicy-is-in-effect","errorCode":null,"errorMessage":"Aborting since DenyRevocationPolicy is in effect.","messagePattern":"Aborting since DenyRevocationPolicy is in effect\\.","errorType":"exception","errorClass":"GeneralSecurityException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/policy/DenyRevocationPolicy.java","lineNumber":23,"sourceCode":"\n/**\n * Implements a deny policy by throwing an exception.\n *\n * @author Marvin S. Addison\n * @since 3.4.6\n */\npublic class DenyRevocationPolicy implements RevocationPolicy<Void> {\n\n    /**\n     * Policy application throws GeneralSecurityException to stop execution of\n     * whatever process invoked application of this policy.\n     *\n     * @param nothing SHOULD be null; ignored in all cases.\n     * @throws GeneralSecurityException Thrown in all cases.\n     */\n    @Override\n    public void apply(final Void nothing) throws GeneralSecurityException {\n        throw new GeneralSecurityException(\"Aborting since DenyRevocationPolicy is in effect.\");\n    }\n}\n","sourceCodeStart":5,"sourceCodeEnd":26,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/revocation/policy/DenyRevocationPolicy.java#L5-L26","documentation":"DenyRevocationPolicy is a RevocationPolicy whose apply(Void) unconditionally throws GeneralSecurityException — it deliberately denies every revocation decision so administrators can configure a hard block with a deterministic, descriptive failure.","triggerScenarios":"apply() is invoked on a policy wired as DenyRevocationPolicy, i.e. any certificate revocation check performed while this policy is configured aborts immediately.","commonSituations":"cas.authn.x509 revocation policy left at a deny default while the deployment expects certificates to authenticate; copied security-hardened configs; unit tests of policy plumbing hitting the always-throwing apply().","solutions":["Configure a real policy (e.g. ThwartRevocationPolicy, AllowRevocationPolicy, or OnlyCertainRevocationPolicy) matching your revocation requirements.","If the hard deny is intentional, catch GeneralSecurityException at the authentication boundary and map it to an 'authentication failed' outcome.","Review which RevocationPolicy bean is actually wired into the X.509 configuration.","Add an integration test with a valid certificate to confirm the chosen policy allows the expected flow."],"exampleFix":"// before\n@Bean\npublic RevocationPolicy revocationPolicy() { return new DenyRevocationPolicy(); }\n// after\n@Bean\npublic RevocationPolicy revocationPolicy() { return new ThwartRevocationPolicy(); }","handlingStrategy":"try-catch","validationCode":"if (revocationPolicy instanceof DenyRevocationPolicy) { /* every apply() will throw: confirm this is intended */ }","typeGuard":null,"tryCatchPattern":"try {\n    revocationPolicy.apply(null);\n} catch (GeneralSecurityException e) {\n    // DenyRevocationPolicy: map to a normal authentication failure\n}","preventionTips":["Audit the configured RevocationPolicy bean at deploy time.","Replace DenyRevocationPolicy with a policy matching your requirements.","Add an integration test proving valid certs authenticate.","Document the intended revocation behavior per environment."],"tags":["x509","revocation","policy","configuration"],"backgroundTag":"policy-denied-by-configuration","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}