{"record":{"id":"c15f327ae2c495ba","repo":"apereo/cas","slug":"an-authentication-pre-processor-could-not-successf","errorCode":null,"errorMessage":"An authentication pre-processor could not successfully process the authentication transaction","messagePattern":"An authentication pre-processor could not successfully process the authentication transaction","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java","lineNumber":63,"sourceCode":"public class DefaultAuthenticationManager implements AuthenticationManager {\n\n    private final AuthenticationEventExecutionPlan authenticationEventExecutionPlan;\n\n    private final ObjectProvider<AuthenticationSystemSupport> authenticationSystemSupport;\n\n    private final boolean principalResolutionFailureFatal;\n\n    private final ConfigurableApplicationContext applicationContext;\n\n    @Override\n    @Audit(\n        action = AuditableActions.AUTHENTICATION,\n        actionResolverName = AuditActionResolvers.AUTHENTICATION_RESOLVER,\n        resourceResolverName = AuditResourceResolvers.AUTHENTICATION_RESOURCE_RESOLVER)\n    public Authentication authenticate(final AuthenticationTransaction transaction) throws Throwable {\n        val result = invokeAuthenticationPreProcessors(transaction);\n        if (!result) {\n            LOGGER.warn(\"An authentication pre-processor could not successfully process the authentication transaction\");\n            throw new AuthenticationException(\"Authentication pre-processor has failed to process transaction\");\n        }\n        val authenticationBuilder = authenticateInternal(transaction);\n        val authentication = authenticationBuilder.build();\n        addAuthenticationMethodAttribute(authenticationBuilder, authentication);\n        populateAuthenticationMetadataAttributes(authenticationBuilder, transaction);\n        invokeAuthenticationPostProcessors(authenticationBuilder, transaction);\n\n        val auth = authenticationBuilder.build();\n        val principal = auth.getPrincipal();\n        if (principal instanceof NullPrincipal) {\n            throw new UnresolvedPrincipalException(auth);\n        }\n        LOGGER.info(\"Authenticated principal [{}] with attributes [{}] via credentials [{}].\",\n            principal.getId(), principal.getAttributes(), transaction.getCredentials());\n        return auth;\n    }\n","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/DefaultAuthenticationManager.java#L45-L81","documentation":"DefaultAuthenticationManager.authenticate first runs all configured AuthenticationPreProcessors (via invokeAuthenticationPreProcessors). If any pre-processor reports failure, the manager logs this warning and throws AuthenticationException before any handler executes, aborting the authentication transaction. Pre-processors are expected to prepare/validate the transaction; a false result means the transaction cannot proceed.","triggerScenarios":"A registered AuthenticationPreProcessor returns false for the given AuthenticationTransaction: e.g. transaction validation failures, captcha/rate-limiting pre-processors rejecting the request, or custom pre-processor logic signaling it could not process the transaction.","commonSituations":"Custom AuthenticationPreProcessor beans deployed with buggy conditions returning false; security pre-processors (IP throttling, risk detection) blocking the request; configuration changes making a pre-processor's expectations invalid (missing attributes in the transaction); multiple pre-processors where one veto silently fails authentication.","solutions":["Inspect the logs immediately before this warning for the specific pre-processor that failed; enable DEBUG logging on org.apereo.cas.authentication to identify it.","Review and fix the failing AuthenticationPreProcessor bean or remove it from the Spring context if it is not needed.","Check the AuthenticationTransaction contents (credentials/principal) against the pre-processor's requirements.","Verify any pre-processor-dependent configuration (rate limits, risk settings, custom conditions) is correct and not permanently vetoing transactions."],"exampleFix":"// before: custom pre-processor that vetoes everything\nclass BadPreProcessor implements AuthenticationPreProcessor {\n    public boolean process(AuthenticationTransaction t) {\n        return false; // accidental veto\n    }\n}\n\n// after\nclass FixedPreProcessor implements AuthenticationPreProcessor {\n    public boolean process(AuthenticationTransaction t) {\n        return t.getCredentials() != null && !t.getCredentials().isEmpty();\n    }\n}","handlingStrategy":"try-catch","validationCode":"// before calling authenticationManager.authenticate\nboolean ready = authenticationPreProcessors.stream()\n    .allMatch(p -> p.supports(transaction) /* or dry-run check if exposed */);","typeGuard":null,"tryCatchPattern":"try {\n    Authentication auth = authenticationManager.authenticate(transaction);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"pre-processor\")) {\n        // identify and fix/disable the vetoing AuthenticationPreProcessor\n    }\n}","preventionTips":["Unit-test every custom AuthenticationPreProcessor's process() return value.","Keep pre-processor beans minimal and log veto reasons inside the processor.","Review pre-processor configurations after CAS upgrades.","Enable DEBUG logging on org.apereo.cas.authentication to catch vetoes early."],"tags":["authentication","pre-processor","transaction","exception"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}