{"record":{"id":"bd093c085f65af4d","repo":"apereo/cas","slug":"is-not-eligible-to-authenticate-as","errorCode":null,"errorMessage":"[{}] is not eligible to authenticate as [{}]","messagePattern":"\\[(.+?)\\] is not eligible to authenticate as \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/SimpleSurrogateAuthenticationService.java","lineNumber":41,"sourceCode":"    private final Map<String, List> eligibleAccounts;\n\n    public SimpleSurrogateAuthenticationService(final Map<String, List> eligibleAccounts,\n                                                final ServicesManager servicesManager,\n                                                final CasConfigurationProperties casProperties,\n                                                final RegisteredServicePrincipalAccessStrategyEnforcer principalAccessStrategyEnforcer,\n                                                final ConfigurableApplicationContext applicationContext) {\n        super(servicesManager, casProperties, principalAccessStrategyEnforcer, applicationContext);\n        this.eligibleAccounts = new HashMap<>(eligibleAccounts);\n    }\n\n    @Override\n    public boolean canImpersonateInternal(final String surrogate, final Principal principal, final Optional<? extends Service> service) {\n        if (this.eligibleAccounts.containsKey(principal.getId())) {\n            val surrogates = this.eligibleAccounts.get(principal.getId());\n            LOGGER.debug(\"Surrogate accounts authorized for [{}] are [{}]\", principal.getId(), surrogates);\n            return surrogates.contains(surrogate);\n        }\n        LOGGER.warn(\"[{}] is not eligible to authenticate as [{}]\", principal.getId(), surrogate);\n        return false;\n    }\n\n    @Override\n    public Collection<String> getImpersonationAccounts(final String username, final Optional<? extends Service> service) {\n        if (this.eligibleAccounts.containsKey(username)) {\n            return this.eligibleAccounts.get(username);\n        }\n        return new ArrayList<>();\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":53,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-surrogate-core/src/main/java/org/apereo/cas/authentication/surrogate/SimpleSurrogateAuthenticationService.java#L23-L53","documentation":"SimpleSurrogateAuthenticationService checks impersonation eligibility against an in-memory map of principal id -> allowed surrogate accounts. In canImpersonateInternal, if the authenticated principal has no entry in eligibleAccounts, it logs this warning and returns false - the principal is simply not configured to impersonate anyone. This is the expected deny path for unconfigured users, not a crash.","triggerScenarios":"canImpersonate(surrogate, principal, service) is invoked and eligibleAccounts.containsKey(principal.getId()) is false, i.e. the principal id is not a key in the configured eligible-accounts map.","commonSituations":"cas.authn.surrogate.simple.eligible-accounts does not include the authenticating user; user typo'd username casing; requests after a config reload dropped the mapping; tests/deploys using a config with fewer accounts than prod.","solutions":["Add the principal to cas.authn.surrogate.simple.eligible-accounts with the desired surrogate accounts.","Verify principal id casing matches the map key exactly.","If eligibility should come from LDAP/JSON instead, switch the surrogate authentication service config rather than the simple map.","Restart/reload CAS after editing the eligible accounts property."],"exampleFix":"// before\ncas.authn.surrogate.simple.eligible-accounts.admin=user1,user2\n// after\ncas.authn.surrogate.simple.eligible-accounts.admin=user1,user2\ncas.authn.surrogate.simple.eligible-accounts.jdoe=user1","handlingStrategy":"validation","validationCode":"boolean eligible = eligibleAccounts.containsKey(principalId)\n    && eligibleAccounts.get(principalId).contains(surrogate);\nif (!eligible) { /* hide impersonation UI / deny before request */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep eligible-accounts keys aligned with authenticated principal ids","Use exact-case usernames","Review map contents after config reloads"],"tags":["surrogate","impersonation","authorization","configuration"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}