{"record":{"id":"bee578fdf4789299","repo":"apereo/cas","slug":"unable-to-accept-response-status-status","errorCode":null,"errorMessage":"Unable to accept response status ${status}","messagePattern":"Unable to accept response status (.+?)","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/intel/RestfulIPAddressIntelligenceService.java","lineNumber":56,"sourceCode":"\n            val parameters = new HashMap<String, String>();\n            parameters.put(\"clientIpAddress\", clientIpAddress);\n\n            val exec = HttpExecutionRequest.builder()\n                .basicAuthPassword(rest.getBasicAuthPassword())\n                .basicAuthUsername(rest.getBasicAuthUsername())\n                .method(HttpMethod.GET)\n                .url(SpringExpressionLanguageValueResolver.getInstance().resolve(rest.getUrl()))\n                .parameters(parameters)\n                .headers(rest.getHeaders())\n                .maximumRetryAttempts(rest.getMaximumRetryAttempts())\n                .build();\n\n            response = HttpUtils.execute(exec);\n            if (response != null) {\n                val status = HttpStatus.valueOf(response.getCode());\n                if (status == HttpStatus.FORBIDDEN || status == HttpStatus.UNAUTHORIZED) {\n                    throw new AuthenticationException(\"Unable to accept response status \" + status);\n                }\n                if (status == HttpStatus.OK || status == HttpStatus.ACCEPTED) {\n                    return IPAddressIntelligenceResponse.allowed();\n                }\n                try (val content = ((HttpEntityContainer) response).getEntity().getContent()) {\n                    val score = Double.parseDouble(IOUtils.toString(content, StandardCharsets.UTF_8));\n                    return IPAddressIntelligenceResponse.builder()\n                        .score(score)\n                        .status(IPAddressIntelligenceResponse.IPAddressIntelligenceStatus.RANKED)\n                        .build();\n                }\n            }\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        } finally {\n            HttpUtils.close(response);\n        }\n        return IPAddressIntelligenceResponse.banned();","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/adaptive/intel/RestfulIPAddressIntelligenceService.java#L38-L74","documentation":"RestfulIPAddressIntelligenceService calls an external REST IP-intelligence endpoint and throws AuthenticationException when the HTTP response status is 403 FORBIDDEN or 401 UNAUTHORIZED. The service cannot obtain a reputation score, so the IP examination fails rather than silently allowing the request.","triggerScenarios":"Configuring cas.authn.adaptive.ip-intel.rest.url to a protected endpoint and having examineInternal receive an HTTP 401/403 response — typically missing, expired, or invalid API credentials on the outbound request.","commonSituations":"API key rotated or expired on the third-party IP intelligence service; wrong auth header configured (or none); firewall/proxy rewriting the request; free-tier endpoint that rejects unauthenticated calls.","solutions":["Set the correct authentication credentials for the REST endpoint (e.g. cas.authn.adaptive.ip-intel.rest.basic-auth-username/password or headers).","Verify the API key/token is still valid by calling the endpoint with curl using the same credentials.","Check proxy/firewall configuration that may strip or alter Authorization headers.","If the service intentionally rejects some IPs, wrap/supersede the intel service with a fallback implementation that treats the failure per policy.","Review endpoint URL correctness — a wrong path often returns 403 instead of 404."],"exampleFix":"// before\ncas.authn.adaptive.ip-intel.rest.url=https://ipintel.example.com/check\n// after\ncas.authn.adaptive.ip-intel.rest.url=https://ipintel.example.com/check\ncas.authn.adaptive.ip-intel.rest.basic-auth-username=mykey\ncas.authn.adaptive.ip-intel.rest.basic-auth-password=mysecret","handlingStrategy":"retry","validationCode":"// validate the endpoint and credentials before enabling\nvar status = HttpUtils.execute(HttpRequest.get(url).build()).getCode();\nif (status == 401 || status == 403) { throw new IllegalStateException(\"IP intel endpoint rejects configured credentials\"); }","typeGuard":null,"tryCatchPattern":"try {\n    response = ipIntelligenceService.examine(ipAddress, service);\n} catch (AuthenticationException e) {\n    LOGGER.warn(\"IP intel endpoint returned 401/403; applying configured fallback policy\", e);\n    return IPAddressIntelligenceResponse.allowed(); // or blocked per policy\n}","preventionTips":["Monitor API key expiration dates for the IP intelligence provider.","Smoke-test the REST endpoint with the same credentials CAS uses, in CI.","Implement a fallback intel service so auth does not hard-fail when the provider rejects you."],"tags":["http","authentication","ip-intelligence","rest"],"backgroundTag":"http-error-response","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}