{"record":{"id":"d1069f0182d02bbf","repo":"apereo/cas","slug":"authentication-failed-with-status","errorCode":null,"errorMessage":"Authentication failed with status: ","messagePattern":"Authentication failed with status: ","errorType":"exception","errorClass":"FailedLoginException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-yubikey-core/src/main/java/org/apereo/cas/adaptors/yubikey/YubiKeyAuthenticationHandler.java","lineNumber":101,"sourceCode":"\n        val authentication = Objects.requireNonNull(WebUtils.getInProgressAuthentication(),\n            \"CAS has no reference to an authentication event to locate a principal\");\n        val principal = authentication.getPrincipal();\n        val uid = principal.getId();\n        val publicId = registry.getAccountValidator().getTokenPublicId(otp);\n        if (!this.registry.isYubiKeyRegisteredFor(uid, publicId)) {\n            LOGGER.debug(\"YubiKey public id [{}] is not registered for user [{}]\", publicId, uid);\n            throw new AccountNotFoundException(\"YubiKey id is not recognized in registry\");\n        }\n\n        try {\n            val response = this.client.verify(otp);\n            val status = response.getStatus();\n            if (status.compareTo(ResponseStatus.OK) == 0) {\n                LOGGER.debug(\"YubiKey response status [{}] at [{}]\", status, response.getTimestamp());\n                return createHandlerResult(yubiKeyCredential, this.principalFactory.createPrincipal(uid));\n            }\n            throw new FailedLoginException(\"Authentication failed with status: \" + status);\n        } catch (final Throwable e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new FailedLoginException(\"YubiKey validation failed: \" + e.getMessage());\n        }\n    }\n}\n","sourceCodeStart":83,"sourceCodeEnd":108,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-yubikey-core/src/main/java/org/apereo/cas/adaptors/yubikey/YubiKeyAuthenticationHandler.java#L83-L108","documentation":"After a successful registry check, the handler calls client.verify(otp) against YubiCloud; if the response status is anything other than OK, it throws FailedLoginException(\"Authentication failed with status: \" + status). This is the standard bad-OTP/verification-failure path of the YubiKey handler.","triggerScenarios":"YubiCloud returns a non-OK status (BAD_OTP, REPLAYED_OTP, BAD_SIGNATURE, MISSING_PARAMETER, etc.) for a YubiKey OTP submitted by a registered user.","commonSituations":"User mistypes the OTP or reuses an old one (replayed); server clock/signature issues cause BAD_SIGNATURE; wrong client id/secret configured; OTP copied incompletely.","solutions":["Have the user generate a fresh OTP by touching the YubiKey; do not replay previous OTPs.","Verify cas.authn.yubikey[0].client-id and secret-key are correct YubiCloud API credentials.","Check outbound connectivity to api.yubikey.com and NTP-synced system time to avoid signature errors.","Inspect the logged status value to identify the specific YubiCloud failure and address it."],"exampleFix":"// before\ncas.authn.yubikey[0].client-id=change-me\n// after\ncas.authn.yubikey[0].client-id=12345\ncas.authn.yubikey[0].secret-key=base64secret==","handlingStrategy":"try-catch","validationCode":"// check OTP shape (device prefix length) before submit\nif (otp == null || otp.length() < 32 || otp.length() > 48) throw new IllegalArgumentException(\"malformed OTP\");","typeGuard":null,"tryCatchPattern":"try {\n    handler.authenticate(credential);\n} catch (FailedLoginException e) {\n    // read YubiCloud status from message, prompt user for a fresh OTP\n}","preventionTips":["Instruct users to touch the YubiKey to generate a new OTP each attempt (no copy/paste reuse).","Configure valid YubiCloud client id/secret and verify them with a test call.","Keep server clocks NTP-synced to avoid signature rejections."],"tags":["yubikey","yubicloud","authentication","otp"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}