{"record":{"id":"b4a980e109fac48b","repo":"apereo/cas","slug":"no-service-authentication-request-is-available-at","errorCode":null,"errorMessage":"No service authentication request is available at [{}]. CAS is configured to disable the flow.","messagePattern":"No service authentication request is available at \\[(.+?)\\]\\. CAS is configured to disable the flow\\.","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/login/InitializeLoginAction.java","lineNumber":42,"sourceCode":"@RequiredArgsConstructor\npublic class InitializeLoginAction extends BaseCasWebflowAction {\n    /**\n     * The services manager with access to the registry.\n     **/\n    protected final ServicesManager servicesManager;\n\n    /**\n     * CAS Properties.\n     */\n    protected final CasConfigurationProperties casProperties;\n    \n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext requestContext) {\n        LOGGER.trace(\"Initialized login sequence\");\n        val service = WebUtils.getService(requestContext);\n        if (service == null && !casProperties.getSso().getServices().isAllowMissingServiceParameter()) {\n            val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(requestContext);\n            LOGGER.warn(\"No service authentication request is available at [{}]. CAS is configured to disable the flow.\", request.getRequestURL());\n            throw new NoSuchFlowExecutionException(requestContext.getFlowExecutionContext().getKey(), UnauthorizedServiceException.required());\n        }\n        return success();\n    }\n\n}\n","sourceCodeStart":24,"sourceCodeEnd":49,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/login/InitializeLoginAction.java#L24-L49","documentation":"This WARN is logged by InitializeLoginAction when the login request carries no service parameter and CAS is configured to reject such requests (cas.sso.services.allow-missing-service-parameter=false). The action then throws UnauthorizedServiceException.required(), aborting the login flow as an unauthorized service request.","triggerScenarios":"A request hits /login without a 'service' (or TARGET) parameter while cas.sso.services.allow-missing-service-parameter is false; WebUtils.getService returns null in doExecuteInternal.","commonSituations":"Users bookmarking the bare /login URL; client applications that forget the service parameter on the login redirect; identity-provider-initiated flows that omit service; misconfiguration when the deployment expects missing-service logins to be allowed.","solutions":["Fix the client/application to always pass the service parameter when redirecting to CAS /login.","If bare-logins should be permitted, set cas.sso.services.allow-missing-service-parameter=true and restart CAS.","Verify the login URL/bookmark includes the encoded service parameter."],"exampleFix":"// before: bare login URL\nGET https://cas.example.org/cas/login\n// after\nGET https://cas.example.org/cas/login?service=https%3A%2F%2Fapp.example.org%2Fcallback","handlingStrategy":"validation","validationCode":"// before calling /login from your client\nconst loginUrl = new URL('https://cas.example.org/cas/login');\nif (!serviceUrl) throw new Error('service parameter is required');\nloginUrl.searchParams.set('service', serviceUrl);","typeGuard":"function hasService(req: { query: Record<string, string> }): boolean {\n  return typeof req.query.service === 'string' && req.query.service.length > 0;\n}","tryCatchPattern":"try {\n  return initializeLogin(requestContext);\n} catch (UnauthorizedServiceException e) {\n  LOGGER.warn(\"Login attempted without a service parameter at [{}]\", requestUrl);\n  return error(\"unauthorized-service\");\n}","preventionTips":["Always build CAS login redirects with an encoded service parameter.","Set cas.sso.services.allow-missing-service-parameter=true only if bare logins are truly supported.","Educate users not to bookmark bare /login URLs.","Check server access logs for service-less /login hits to spot misbehaving clients."],"tags":["cas","login","webflow","missing-parameter"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}