{"record":{"id":"d5511b03714a8451","repo":"apereo/cas","slug":"delegated-authentication-has-failed-with-client","errorCode":null,"errorMessage":"Delegated authentication has failed with client ","messagePattern":"Delegated authentication has failed with client ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java","lineNumber":113,"sourceCode":"                && ssoEvaluator.singleSignOnSessionExists(context);\n            if (isSingleSignOnSessionActive) {\n                LOGGER.trace(\"Found an existing single sign-on session\");\n                service = populateContextWithService(context, service);\n                if (ssoEvaluator.singleSignOnSessionAuthorizedForService(context)) {\n                    val providers = configContext.getDelegatedClientIdentityProvidersProducer().produce(context);\n                    LOGGER.debug(\"Skipping delegation and routing back to CAS authentication flow with providers [{}]\", providers);\n                    return super.doExecuteInternal(context);\n                }\n                val resolvedService = ssoEvaluator.resolveServiceFromRequestContext(context);\n                LOGGER.debug(\"Single sign-on session is unauthorized for service [{}]\", resolvedService);\n                removeTicketGrantingTicketIfAny(context, clientName, resolvedService);\n            } else if (StringUtils.isNotBlank(clientName) && !isLogoutRequest(clientCredential)) {\n                LOGGER.debug(\"Single sign-on session is inactive for service [{}]\", service);\n                removeTicketGrantingTicketIfAny(context, clientName, service);\n            }\n\n            if (failureEvaluator.evaluate(request, response.getStatus()).isPresent()) {\n                throw new IllegalArgumentException(\"Delegated authentication has failed with client \" + clientName);\n            }\n\n            if (DelegationWebflowUtils.hasDelegatedClientAuthenticationCandidateProfile(context)) {\n                val profile = DelegationWebflowUtils.getDelegatedClientAuthenticationCandidateProfile(context, DelegatedAuthenticationCandidateProfile.class);\n                val up = profile.toUserProfile(clientName);\n                val clientCredentialSelected = new ClientCredential(clientName, up);\n                WebUtils.putCredential(context, clientCredentialSelected);\n                return super.doExecuteInternal(context);\n            }\n\n            if (clientCredential.isPresent()) {\n                service = populateContextWithService(context, service);\n                val client = findDelegatedClientByName(clientName, context);\n                verifyClientIsAuthorizedForService(context, service, client);\n                DelegationWebflowUtils.putDelegatedAuthenticationClientName(context, client.getName());\n                if (isLogoutRequest) {\n                    val callContext = new CallContext(webContext, configContext.getSessionStore());\n                    throw client.processLogout(callContext, clientCredential.get().getCredentials());","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/web/flow/actions/DelegatedClientAuthenticationAction.java#L95-L131","documentation":"DelegatedClientAuthenticationAction.doExecuteInternal evaluates the callback response status with a failureEvaluator; when the evaluator detects a failure, it throws IllegalArgumentException(\"Delegated authentication has failed with client \" + clientName), aborting the webflow.","triggerScenarios":"The delegated IdP callback returns an HTTP status the failure evaluator classifies as failed (e.g. 401/403/500, OAuth error=access_denied in the callback), while a clientName is present and it is not a logout request.","commonSituations":"User cancels consent at the IdP (access_denied); wrong client secret causing IdP error responses; IdP downtime returning 5xx; misconfigured redirect/callback URIs producing error redirects.","solutions":["Inspect the callback request/IdP error (logs show clientName and status) to learn why the IdP reported failure","Fix the delegated client configuration (secrets, redirect URI) or the user action (cancel/consent denial) accordingly","Check IdP health/status page if the status indicates a server-side 5xx"],"exampleFix":"// before\ncas.authn.pac4j.oidc[0].generic.secret=stale-secret   // IdP responds 401 on token exchange\n// after\ncas.authn.pac4j.oidc[0].secret=${OIDC_CLIENT_SECRET}  // rotated, correct secret","handlingStrategy":"try-catch","validationCode":"// inspect callback before executing flow\nif (request.getParameter(\"error\") != null) { handleDelegationError(request.getParameter(\"error\")); }","typeGuard":null,"tryCatchPattern":"try { executeDelegatedFlow(context); }\ncatch (IllegalArgumentException e) { log clientName; route user to a friendly delegation-failure view; }","preventionTips":["Handle IdP error codes (access_denied) as graceful UX, not hard failures","Keep IdP client secrets/redirect URIs in sync","Monitor IdP status endpoints"],"tags":["delegated-authentication","pac4j","webflow","idp"],"backgroundTag":"http-error-response","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}