{"record":{"id":"e07af7a8ad358ff6","repo":"apereo/cas","slug":"service-access-for-is-denied","errorCode":null,"errorMessage":"Service access for [{}] is denied","messagePattern":"Service access for \\[(.+?)\\] is denied","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java","lineNumber":64,"sourceCode":"                                                  final HttpServletRequest request) throws Throwable {\n        val tenantDefinition = tenantExtractor.extract(request);\n        return (tenantDefinition.isEmpty() || isDelegatedClientAuthorizedForTenant(clientName, tenantDefinition.get()))\n            && handleAuthorizationForService(clientName, service);\n    }\n\n    protected boolean handleAuthorizationForService(final String clientName, final Service service) throws Throwable {\n        if (service == null || StringUtils.isBlank(service.getId())) {\n            LOGGER.trace(\"Can not evaluate delegated authentication policy without a service\");\n            return true;\n        }\n        if (StringUtils.isBlank(clientName)) {\n            LOGGER.trace(\"No identity provider is provided to enforce authorization for delegated authentication. SSO session \"\n                + \"may have been established without delegated authentication\");\n            return true;\n        }\n        val registeredService = servicesManager.findServiceBy(service);\n        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            LOGGER.warn(\"Service access for [{}] is denied\", registeredService);\n            return false;\n        }\n        LOGGER.trace(\"Located registered service definition [{}] matching [{}]\", registeredService, service);\n        val auditContext = AuditableContext.builder()\n            .registeredService(registeredService)\n            .service(service)\n            .properties(CollectionUtils.wrap(Client.class.getSimpleName(), clientName))\n            .build();\n        val result = delegatedAuthenticationPolicyEnforcer.execute(auditContext);\n        if (!result.isExecutionFailure()) {\n            LOGGER.debug(\"Delegated authentication policy for [{}] allows for using provider [{}]\", registeredService, clientName);\n            return true;\n        }\n        LOGGER.warn(\"Delegated authentication policy for [{}] refuses access to provider [{}]\", registeredService.getServiceId(), clientName);\n        return false;\n    }\n\n    protected boolean isDelegatedClientAuthorizedForTenant(final String clientName, final TenantDefinition tenantDefinition) {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java#L46-L82","documentation":"BaseDelegatedClientIdentityProviderAuthorizer.handleAuthorizationForService warns and returns false when the service matched by ServicesManager either is not found or its access strategy disallows access for the requested service URL during delegated authentication authorization. The delegated authentication attempt for that service is then refused.","triggerScenarios":"isDelegatedClientAuthorizedFor invokes handleAuthorizationForService with a service URL; servicesManager.findServiceBy(service) returns null (unregistered service) or registeredService.getAccessStrategy().isServiceAccessAllowed(...) returns false (e.g. service excluded, unauthorized pattern, or access strategy disabled).","commonSituations":"Service not registered or URL pattern mismatch so findServiceBy returns null; registered service access strategy (allowedAttributes/authorizedToProxy/etc., enabled=false) denies the request; service recently disabled while users still access it.","solutions":["Register the service in the CAS services registry (or fix the serviceId/pattern so it matches) so findServiceBy locates it.","Fix the registered service's access strategy (set enabled=true, correct allowed attributes/URLs) so isServiceAccessAllowed returns true.","Verify the request's service URL matches the intended registered service definition."],"exampleFix":"// before: service JSON\n{ \"@class\": \"...RegexRegisteredService\", \"serviceId\": \"^https://old\\.example\\.com/.*\", \"id\": 1 }\n// after\n{ \"@class\": \"...RegexRegisteredService\", \"serviceId\": \"^https://app\\.example\\.com/.*\", \"id\": 1 }","handlingStrategy":"validation","validationCode":"RegisteredService svc = servicesManager.findServiceBy(service);\nboolean allowed = svc != null && svc.getAccessStrategy().isServiceAccessAllowed(svc, service);\nif (!allowed) { /* do not start delegated auth for this service */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register every service URL that uses delegated authentication.","Review access-strategy enabled flags during service registry audits."],"tags":["pac4j","delegated-authentication","service-access","authorization"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}