{"record":{"id":"abb35aa9884b7193","repo":"apereo/cas","slug":"registered-openid-connect-relying-party-does-not-s","errorCode":null,"errorMessage":"Registered OpenID Connect relying party does not support backchannel authentication requests","messagePattern":"Registered OpenID Connect relying party does not support backchannel authentication requests","errorType":"exception","errorClass":"InvalidCibaRequestException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/ciba/AccessTokenCibaGrantRequestExtractor.java","lineNumber":68,"sourceCode":"        val service = configurationContext.getAuthenticationBuilder()\n            .buildService(registeredService, context, true);\n\n        val cibaFactory = (OidcCibaRequestFactory) configurationContext.getTicketFactory().get(OidcCibaRequest.class);\n        val decodedId = cibaFactory.decodeId(authRequestId);\n        val cibaRequest = configurationContext.getTicketRegistry().getTicket(decodedId, OidcCibaRequest.class);\n\n        val audit = AuditableContext.builder()\n            .service(service)\n            .registeredService(registeredService)\n            .authentication(cibaRequest.getAuthentication())\n            .build();\n        val accessResult = configurationContext.getRegisteredServiceAccessStrategyEnforcer().execute(audit);\n        accessResult.throwExceptionIfNeeded();\n\n        if (!registeredService.getSupportedGrantTypes().contains(getGrantType().getType())\n            || StringUtils.isBlank(registeredService.getBackchannelClientNotificationEndpoint())\n            || StringUtils.isBlank(registeredService.getBackchannelTokenDeliveryMode())) {\n            throw new InvalidCibaRequestException(\"Registered OpenID Connect relying party does not support backchannel authentication requests\");\n        }\n        val deliveryMode = OidcBackchannelTokenDeliveryModes.valueOf(registeredService.getBackchannelTokenDeliveryMode().toUpperCase(Locale.ENGLISH));\n        if (deliveryMode != OidcBackchannelTokenDeliveryModes.POLL && deliveryMode != OidcBackchannelTokenDeliveryModes.PING) {\n            throw new InvalidCibaRequestException(\"Backchannel token delivery mode cannot grant access tokens\");\n        }\n        if (!cibaRequest.isReady()) {\n            throw new InvalidCibaRequestException(\"CIBA request %s is not ready to grant access tokens\".formatted(authRequestId));\n        }\n        \n        return AccessTokenRequestContext.builder()\n            .service(service)\n            .authentication(cibaRequest.getAuthentication())\n            .registeredService(registeredService)\n            .responseType(getResponseType())\n            .grantType(getGrantType())\n            .scopes(cibaRequest.getScopes())\n            .userProfile(profile)\n            .clientId(registeredService.getClientId())","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/ciba/AccessTokenCibaGrantRequestExtractor.java#L50-L86","documentation":"AccessTokenCibaGrantRequestExtractor.extractRequest throws InvalidCibaRequestException with this message when the client polls the CIBA token endpoint but its registered OIDC service is not set up for backchannel authentication: it lacks the ciba grant type, a backchannel client notification endpoint, or a backchannel token delivery mode. CAS rejects the request before doing any token work.","triggerScenarios":"A CIBA token request (grant_type=urn:openid:params:grant-type:ciba) arrives for a registeredService where supportedGrantTypes omits CIBA, or backchannelClientNotificationEndpoint is blank, or backchannelTokenDeliveryMode is blank.","commonSituations":"Client registered for authorization_code only tries to use CIBA; admin created the service but never filled the backchannel settings (notification endpoint, delivery mode); service definition cloned without CIBA fields.","solutions":["Add the CIBA grant type to the service's supported grant types","Set backchannelClientNotificationEndpoint and backchannelTokenDeliveryMode (poll or ping) on the registered service","Confirm the client is actually meant to use CIBA; otherwise fix the client to use its registered grant type"],"exampleFix":"// before (service definition)\n\"supportedGrantTypes\": [\"authorization_code\"],\n\"backchannelTokenDeliveryMode\": null\n// after\n\"supportedGrantTypes\": [\"authorization_code\",\"urn:openid:params:grant-type:ciba\"],\n\"backchannelTokenDeliveryMode\": \"poll\",\n\"backchannelClientNotificationEndpoint\": \"https://client.example.org/ciba\"","handlingStrategy":"validation","validationCode":"var cibaReady = service.getSupportedGrantTypes().contains(\"urn:openid:params:grant-type:ciba\")\n    && StringUtils.isNotBlank(service.getBackchannelClientNotificationEndpoint())\n    && StringUtils.isNotBlank(service.getBackchannelTokenDeliveryMode());\nif (!cibaReady) throw new IllegalStateException(\"Client \" + service.getClientId() + \" is not CIBA-capable\");","typeGuard":null,"tryCatchPattern":"try { return extractor.extractRequest(context); } catch (InvalidCibaRequestException e) { if (e.getMessage().contains(\"does not support backchannel\")) { throw new UnauthorizedClientException(e.getMessage()); } throw e; }","preventionTips":["Register CIBA grant type plus notification endpoint and delivery mode on any client that will use CIBA","Reconcile client capabilities with the CAS service registry before enabling CIBA in the client SDK","Test CIBA flows in staging with the exact registered service definition"],"tags":["oidc","ciba","configuration","grant-type"],"backgroundTag":"operation-not-supported","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}