{"record":{"id":"c7546a1f8dd50f5d","repo":"apereo/cas","slug":"response-is-not-recognized","errorCode":null,"errorMessage":"Response [{}] is not recognized","messagePattern":"Response \\[(.+?)\\] is not recognized","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/server/AbstractRadiusServer.java","lineNumber":123,"sourceCode":"        if (configurationContext.getNasPortType() != -1) {\n            attributeList.add(new Attr_NASPortType(configurationContext.getNasPortType()));\n        }\n        val client = configurationContext.getRadiusClientFactory().newInstance();\n        try {\n            val request = new AccessRequest(client, attributeList);\n            LOGGER.debug(\"RADIUS access request prepared as [{}]\", request.toString(true, true));\n\n            val response = authenticateRequest(client, request);\n            LOGGER.debug(\"RADIUS response from [{}]: [{}] as [{}]\", client.getRemoteInetAddress().getCanonicalHostName(),\n                response.getClass().getName(), response.toString(true, true));\n\n            if (response instanceof AccessAccept || response instanceof AccessChallenge) {\n                val attributes = response.getAttributes().getAttributeList();\n                LOGGER.debug(\"Radius response code [{}] accepted with attributes [{}] and identifier [{}]\",\n                    response.getCode(), attributes, response.getIdentifier());\n                return new CasRadiusResponse(response.getCode(), response.getIdentifier(), attributes);\n            }\n            LOGGER.warn(\"Response [{}] is not recognized\", response);\n        } finally {\n            if (client != null) {\n                client.close();\n            }\n        }\n        return null;\n    }\n\n    /**\n     * Gets radius authenticator.\n     *\n     * @return the radius authenticator\n     */\n    public RadiusAuthenticator getRadiusAuthenticator() {\n        return RadiusClient.getAuthProtocol(configurationContext.getProtocol().getName());\n    }\n\n    /**","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-radius-core/src/main/java/org/apereo/cas/adaptors/radius/server/AbstractRadiusServer.java#L105-L141","documentation":"AbstractRadiusServer.authenticate logs this warning when the RADIUS response packet received is neither an AccessAccept nor an AccessChallenge (e.g. AccessReject or an unrecognized code). The method then returns null, signaling authentication could not be completed with this server.","triggerScenarios":"The RADIUS server replies with a packet whose type is not AccessAccept/AccessChallenge — most commonly an AccessReject due to bad credentials, or an unknown/unhandled response code from a nonstandard server.","commonSituations":"Wrong user credentials; server rejecting the NAS/shared-secret pairing; RADIUS server implementations returning unusual response codes; request-routing to a server that rejects the NAS IP.","solutions":["Inspect the logged response object to see the actual RADIUS code; if it's AccessReject, fix credentials or NAS/shared-secret configuration.","Verify the client IP is registered as a known NAS on the RADIUS server and the shared secret matches.","Test the same request with radtest/radclient to confirm how the server responds outside CAS.","If your server returns custom codes, ensure the CAS RADIUS client/library version supports them."],"exampleFix":"# before — credentials rejected, response unrecognized\nusername: alice / password: wrong\n# after — validate credentials against the RADIUS server first\nradtest alice correctpassword localhost 0 testing123  # expect Access-Accept","handlingStrategy":"try-catch","validationCode":"radtest $user $pass $radiusHost 0 $sharedSecret || echo 'credentials or NAS config rejected'","typeGuard":null,"tryCatchPattern":"val response = radiusServer.authenticate(request);\nif (response == null) {\n  // treat as failed authentication; check server logs for 'Response is not recognized'\n}","preventionTips":["Validate credentials against the RADIUS server with radtest before wiring CAS","Register the CAS host IP as a NAS on the RADIUS server","Confirm shared secret matches exactly on both sides"],"tags":["radius","authentication","unexpected-response"],"backgroundTag":"unexpected-api-response-shape","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}