{"record":{"id":"9a44ca2867d68b7d","repo":"apereo/cas","slug":"requested-grant-type-is-not-authorized-by-ser","errorCode":null,"errorMessage":"Requested grant type [{}] is not authorized by service definition [{}]","messagePattern":"Requested grant type \\[(.+?)\\] is not authorized by service definition \\[(.+?)\\]","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20PasswordGrantTypeTokenRequestValidator.java","lineNumber":60,"sourceCode":"        val clientIdAndSecret = configurationContext.getRequestParameterResolver().resolveClientIdAndClientSecret(callContext);\n        val clientId = StringUtils.defaultIfBlank(clientIdAndSecret.getKey(), (String) uProfile.getAttribute(OAuth20Constants.CLIENT_ID));\n        if (StringUtils.isBlank(clientId)) {\n            LOGGER.warn(\"No client id is provided in the request\");\n            return false;\n        }\n        LOGGER.debug(\"Received grant type [{}] with client id [{}]\", grantType, clientId);\n        val registeredService = OAuth20Utils.getRegisteredOAuthServiceByClientId(configurationContext.getServicesManager(), clientId);\n        RegisteredServiceAccessStrategyUtils.ensureServiceAccessIsAllowed(registeredService);\n        val service = configurationContext.getWebApplicationServiceServiceFactory().createService(registeredService.getServiceId());\n        val audit = AuditableContext.builder()\n            .service(service)\n            .registeredService(registeredService)\n            .build();\n        val accessResult = configurationContext.getRegisteredServiceAccessStrategyEnforcer().execute(audit);\n        accessResult.throwExceptionIfNeeded();\n\n        if (!isGrantTypeSupportedBy(registeredService, grantType)) {\n            LOGGER.warn(\"Requested grant type [{}] is not authorized by service definition [{}]\",\n                grantType, registeredService.getServiceId());\n            return false;\n        }\n        return true;\n    }\n}\n","sourceCodeStart":42,"sourceCodeEnd":67,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/validator/token/OAuth20PasswordGrantTypeTokenRequestValidator.java#L42-L67","documentation":"After enforcing the registered service's access strategy, OAuth20PasswordGrantTypeTokenRequestValidator checks isGrantTypeSupportedBy(registeredService, grantType). When the service definition does not list the `password` grant type (urn:ietf:params:oauth:grant-type:password) among its authorized grant types, the validator warns and returns false, rejecting the token request.","triggerScenarios":"A token request with grant_type=password for a registered service whose supportedGrantTypes collection is empty or does not include the password grant type.","commonSituations":"Service JSON entry created without `supportedGrantTypes`; CAS tightened enforcement so previously tolerated empty lists now block the password grant; admin added response types but forgot grant types.","solutions":["Add \"urn:ietf:params:oauth:grant-type:password\" to the service definition's supportedGrantTypes.","Reload the service registry so the updated definition is used.","If the password grant is deprecated for your deployment, migrate the client to authorization_code or refresh_token grants.","Confirm the client actually sends grant_type=password and not another type that is similarly unlisted."],"exampleFix":"// before (service JSON)\n\"supportedGrantTypes\": []\n// after\n\"supportedGrantTypes\": [\"urn:ietf:params:oauth:grant-type:password\"]","handlingStrategy":"validation","validationCode":"const PASSWORD_GRANT = 'urn:ietf:params:oauth:grant-type:password';\nif (!service.supportedGrantTypes?.includes(PASSWORD_GRANT)) {\n  throw new Error('password grant not authorized for this service definition');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["List every grant type each client uses in its service definition","Re-check supportedGrantTypes after CAS upgrades (enforcement has tightened over versions)","Keep service JSON in version control and review changes"],"tags":["oauth","grant-type","password-grant","service-definition"],"backgroundTag":"unsupported-operation","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}