{"record":{"id":"ca07ff9f46e4977c","repo":"apereo/cas","slug":"denied-service","errorCode":null,"errorMessage":"Denied: <service>","messagePattern":"Denied: <service>","errorType":"exception","errorClass":"UnauthorizedSsoServiceException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/RegisteredServiceAuthenticationPolicyResolver.java","lineNumber":63,"sourceCode":"        val registeredService = servicesManager.findServiceBy(service);\n        val criteria = Objects.requireNonNull(registeredService).getAuthenticationPolicy().getCriteria();\n        val policies = new LinkedHashSet<AuthenticationPolicy>(1);\n        if (criteria != null) {\n            policies.add(criteria.toAuthenticationPolicy(registeredService));\n        }\n        LOGGER.debug(\"Authentication policies for this transaction are [{}]\", policies);\n        return policies;\n    }\n\n    @Override\n    public boolean supports(final AuthenticationTransaction transaction) throws Throwable {\n        val service = authenticationServiceSelectionPlan.resolveService(transaction.getService());\n        if (service != null) {\n            val registeredService = servicesManager.findServiceBy(service);\n            LOGGER.trace(\"Located registered service definition [{}] for this authentication transaction\", registeredService);\n            if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n                LOGGER.warn(\"Service [{}] is not allowed to use SSO.\", service);\n                throw new UnauthorizedSsoServiceException(\"Denied: %s\".formatted(service));\n            }\n            val authenticationPolicy = registeredService.getAuthenticationPolicy();\n            if (authenticationPolicy != null) {\n                val criteria = authenticationPolicy.getCriteria();\n                return criteria != null;\n            }\n        }\n        return false;\n    }\n}\n","sourceCodeStart":45,"sourceCodeEnd":74,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/RegisteredServiceAuthenticationPolicyResolver.java#L45-L74","documentation":"The service in the current authentication transaction was denied SSO: ServicesManager returned no registered service for it, or the registered service's access strategy disallowed access (isServiceAccessAllowed returned false). UnauthorizedSsoServiceException is raised during supports() so the registered-service authentication policy resolver will not apply to this transaction. The input at fault is the unresolved/disallowed service.","triggerScenarios":"Thrown at core/cas-server-core-authentication-api/src/main/java/org/apereo/cas/authentication/policy/RegisteredServiceAuthenticationPolicyResolver.java:63 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Register the service in the service registry or fix its service ID/pattern so it matches","Check the registered service's access strategy (enabled, ssoEnabled, expiry/casProperties) for denial reasons","Verify authenticationServiceSelectionPlan resolves the incoming service to the expected registered service"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}