{"record":{"id":"a692dd9f509b8899","repo":"apereo/cas","slug":"unexpected-activationstatus","errorCode":null,"errorMessage":"Unexpected activationStatus: [{}]","messagePattern":"Unexpected activationStatus: \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/web/flow/actions/InweboCheckUserAction.java","lineNumber":96,"sourceCode":"                }\n\n                if (activationStatus == 0) {\n                    LOGGER.debug(\"User is not registered: [{}]\", login);\n                    if (isVirtualAuthenticator) {\n                        return customEvent(VA);\n                    } else if (isMAccessWeb) {\n                        flowScope.put(MUST_ENROLL, true);\n                        WebUtils.addErrorMessageToContext(requestContext, \"cas.inwebo.error.usernotregistered\");\n                    }\n\n                } else if (activationStatus == 1) {\n                    LOGGER.debug(\"User can only handle push notifications: [{}]\", login);\n                    if (pushEnabled) {\n                        return customEvent(PUSH);\n                    }\n\n                } else if (activationStatus == 2 || activationStatus == 3) {\n                    LOGGER.warn(\"Unexpected activationStatus: [{}]\", activationStatus);\n\n                } else if (activationStatus == BROWSER_AUTHENTICATION_STATUS) {\n                    LOGGER.debug(\"User can only handle browser authentication: [{}]\", login);\n                    if (isVirtualAuthenticator) {\n                        return customEvent(VA);\n                    } else if (isMAccessWeb) {\n                        return customEvent(MA);\n                    }\n\n                } else if (activationStatus == PUSH_AND_BROWSER_AUTHENTICATION_STATUS) {\n                    LOGGER.debug(\"User has both authentication methods: [{}]\", login);\n                    if (pushEnabled) {\n                        if (isVirtualAuthenticator || isMAccessWeb) {\n                            return customEvent(SELECT);\n                        }\n                        return customEvent(PUSH);\n                    } else {\n                        if (isVirtualAuthenticator) {","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-inwebo-mfa/src/main/java/org/apereo/cas/support/inwebo/web/flow/actions/InweboCheckUserAction.java#L78-L114","documentation":"This WARN log is emitted by InweboCheckUserAction.doExecuteInternal when the Inwebo API returns an activationStatus value (2 or 3) that the MFA flow does not map to any authentication event. The action branches on known statuses (push-capable, browser-authenticator, etc.) and logs anything else as unexpected, then falls through without returning a custom event. The user's Inwebo device state is in a mode CAS cannot handle, so the flow proceeds on an undefined path.","triggerScenarios":"Inwebo web service returns activationStatus == 2 or 3 (per Inwebo API, states such as 'pending synchronization' or other non-authenticatable device states) during checkAuth during the MFA webflow; a user whose only devices are in those states authenticates with cas-server-support-inwebo-mfa enabled.","commonSituations":"Users with newly added but not yet synchronized Inwebo devices; devices disabled/blocked on the Inwebo admin console; Inwebo server/API version upgrade that changed or added status codes not yet handled by this CAS version.","solutions":["Inspect the user's device state in the Inwebo administration console and re-synchronize or reactivate the device so it reaches a supported status (1=software, 4=push, 5=browser, etc.)","Upgrade CAS / the inwebo support module to a version that maps activationStatus 2 and 3 to explicit flow events","Add custom handling in your flow (or subclass InweboCheckUserAction) to return a defined event for statuses 2 and 3 instead of falling through","Confirm the Inwebo service ID/API credentials are correct, since mismatched service configuration can surface odd status codes"],"exampleFix":"// before\n} else if (activationStatus == 2 || activationStatus == 3) {\n    LOGGER.warn(\"Unexpected activationStatus: [{}]\", activationStatus);\n}\n// after\n} else if (activationStatus == 2 || activationStatus == 3) {\n    LOGGER.warn(\"Unexpected activationStatus: [{}]\", activationStatus);\n    return customEvent(DEVICE_PENDING_OR_BLOCKED);\n}","handlingStrategy":"fallback","validationCode":"const supportedStatuses = [1, 4, 5];\nif (!supportedStatuses.includes(activationStatus)) { console.warn('Unsupported Inwebo activationStatus: ' + activationStatus); }","typeGuard":null,"tryCatchPattern":"try { val result = inweboCheckUserAction.execute(context); } catch (Exception e) { LOGGER.warn(\"Inwebo check failed; falling back to denial event\", e); return errorEvent(); }","preventionTips":["Keep the Inwebo module updated for new device status codes","Monitor Inwebo admin console for users with pending/blocked devices","Map unknown statuses to an explicit deny/pending flow event in customizations","Test MFA flow against all device states your organization uses"],"tags":["mfa","inwebo","webflow","unhandled-status"],"backgroundTag":"invalid-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}