{"record":{"id":"9f3d0d7f5dd6c7d6","repo":"apereo/cas","slug":"no-credentials-are-provided-or-extracted-to-authen","errorCode":null,"errorMessage":"No credentials are provided or extracted to authenticate the REST request","messagePattern":"No credentials are provided or extracted to authenticate the REST request","errorType":"exception","errorClass":"BadRestRequestException","httpStatus":400,"severity":"error","filePath":"support/cas-server-support-rest-core/src/main/java/org/apereo/cas/support/rest/resources/ServiceTicketResource.java","lineNumber":103,"sourceCode":"            @Parameter(name = \"tgtId\", required = true, in = ParameterIn.PATH, description = \"Ticket-granting ticket id\"),\n            @Parameter(name = \"requestBody\", required = false, description = \"Request body containing credentials\")\n        })\n    public ResponseEntity<String> createServiceTicket(\n        final HttpServletRequest httpServletRequest,\n        @RequestBody(required = false)\n        final MultiValueMap<String, String> requestBody,\n        @PathVariable final String tgtId) {\n        try {\n            val authn = ticketRegistrySupport.getAuthenticationFrom(StringEscapeUtils.escapeHtml4(tgtId));\n            if (authn == null) {\n                throw new InvalidTicketException(tgtId);\n            }\n            val service = Objects.requireNonNull(argumentExtractor.extractService(httpServletRequest),\n                \"Target service/application is unspecified or unrecognized in the request\");\n            if (BooleanUtils.toBoolean(httpServletRequest.getParameter(CasProtocolConstants.PARAMETER_RENEW))) {\n                val credential = credentialFactory.fromRequest(httpServletRequest, requestBody);\n                if (credential == null || credential.isEmpty()) {\n                    throw new BadRestRequestException(\"No credentials are provided or extracted to authenticate the REST request\");\n                }\n                val authenticationResult = authenticationSystemSupport.finalizeAuthenticationTransaction(service, credential);\n                return serviceTicketResourceEntityResponseFactory.build(tgtId, service, Objects.requireNonNull(authenticationResult));\n            }\n            val builder = authenticationSystemSupport.getAuthenticationResultBuilderFactory().newBuilder();\n            val authenticationResult = builder.collect(authn).build(service);\n            return serviceTicketResourceEntityResponseFactory.build(tgtId, service, Objects.requireNonNull(authenticationResult));\n        } catch (final InvalidTicketException e) {\n            return new ResponseEntity<>(StringEscapeUtils.escapeHtml4(tgtId) + \" could not be found or is considered invalid\", HttpStatus.NOT_FOUND);\n        } catch (final AuthenticationException e) {\n            return RestResourceUtils.createResponseEntityForAuthnFailure(e, httpServletRequest, applicationContext);\n        } catch (final BadRestRequestException e) {\n            LoggingUtils.error(LOGGER, e);\n            return new ResponseEntity<>(StringEscapeUtils.escapeHtml4(e.getMessage()), HttpStatus.BAD_REQUEST);\n        } catch (final UnauthorizedServiceException e) {\n            LoggingUtils.error(LOGGER, e);\n            return new ResponseEntity<>(StringEscapeUtils.escapeHtml4(e.getMessage()), HttpStatus.FORBIDDEN);\n        } catch (final Throwable e) {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-rest-core/src/main/java/org/apereo/cas/support/rest/resources/ServiceTicketResource.java#L85-L121","documentation":"Thrown as BadRestRequestException when the renew=true path of the REST service-ticket endpoint cannot extract any credential from the request. With renew enabled, CAS requires fresh credentials in the request body (username/password or similar); if credentialFactory.fromRequest returns null or an empty collection the request is rejected.","triggerScenarios":"Calling /v1/tickets/{tgtId}?renew=true (or PARAMETER_RENEW parameter) without supplying credentials in the request body; sending the body with wrong Content-Type so the credential factory cannot parse it; credential factory not configured to recognize the provided credential type.","commonSituations":"Developer adds renew=true to force re-authentication but reuses the old TGT-only request without body; client sends JSON instead of the form-encoded MultiValueMap the factory expects; custom credential factory missing from the REST configuration.","solutions":["Include valid credentials in the request body (e.g. username=...&password=... form data) when using renew=true.","Remove the renew parameter if re-authentication is not actually required (the existing TGT authentication will be reused).","Ensure Content-Type is application/x-www-form-urlencoded (or as expected by the configured credential factory) so the body is parsed.","Verify a REST credential factory bean is registered that supports the credential type being sent."],"exampleFix":"// before\ncurl -X POST 'https://cas/v1/tickets/TGT-1-abc/service?renew=true' -d 'service=https://app'\n// after\ncurl -X POST 'https://cas/v1/tickets/TGT-1-abc/service?renew=true' -d 'service=https://app' -d 'username=casuser' -d 'password=mypassword'","handlingStrategy":"validation","validationCode":"// Before sending a renew=true request, ensure credentials are attached:\nif (renew && (username == null || username.isBlank() || password == null || password.isBlank())) {\n    throw new IllegalArgumentException(\"renew=true requires username/password in the request body\");\n}","typeGuard":null,"tryCatchPattern":"try { requestServiceTicket(tgtId, service, renew, creds); }\ncatch (BadRestRequestException e) {\n    // fall back to non-renew path or surface a clear credential-required error\n    requestServiceTicket(tgtId, service, false, null);\n}","preventionTips":["Only add renew=true when fresh credentials will also be supplied.","Send form-encoded bodies (application/x-www-form-urlencoded) the REST credential factory can parse.","Keep a configured credential factory that supports the credential type used.","Document required body parameters for renew flows in the client SDK."],"tags":["rest","cas","credentials","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}