{"record":{"id":"e1dcb5fccda69a4e","repo":"apereo/cas","slug":"delegated-authentication-policy-for-refuses-a","errorCode":null,"errorMessage":"Delegated authentication policy for [{}] refuses access to provider [{}]","messagePattern":"Delegated authentication policy for \\[(.+?)\\] refuses access to provider \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java","lineNumber":78,"sourceCode":"            return true;\n        }\n        val registeredService = servicesManager.findServiceBy(service);\n        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            LOGGER.warn(\"Service access for [{}] is denied\", registeredService);\n            return false;\n        }\n        LOGGER.trace(\"Located registered service definition [{}] matching [{}]\", registeredService, service);\n        val auditContext = AuditableContext.builder()\n            .registeredService(registeredService)\n            .service(service)\n            .properties(CollectionUtils.wrap(Client.class.getSimpleName(), clientName))\n            .build();\n        val result = delegatedAuthenticationPolicyEnforcer.execute(auditContext);\n        if (!result.isExecutionFailure()) {\n            LOGGER.debug(\"Delegated authentication policy for [{}] allows for using provider [{}]\", registeredService, clientName);\n            return true;\n        }\n        LOGGER.warn(\"Delegated authentication policy for [{}] refuses access to provider [{}]\", registeredService.getServiceId(), clientName);\n        return false;\n    }\n\n    protected boolean isDelegatedClientAuthorizedForTenant(final String clientName, final TenantDefinition tenantDefinition) {\n        val allowedProviders = tenantDefinition.getDelegatedAuthenticationPolicy() != null\n            ? tenantDefinition.getDelegatedAuthenticationPolicy().getAllowedProviders()\n            : List.of();\n        val allowedByTenant = StringUtils.isBlank(clientName) || allowedProviders == null\n            || allowedProviders.isEmpty() || allowedProviders.contains(clientName);\n        LOGGER.debug(\"Tenant [{}] allows for delegated authentication with provider [{}]: [{}]\", tenantDefinition.getId(), clientName,\n            BooleanUtils.toStringYesNo(allowedByTenant));\n        return allowedByTenant;\n    }\n}\n","sourceCodeStart":60,"sourceCodeEnd":93,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-pac4j-core/src/main/java/org/apereo/cas/pac4j/client/authz/BaseDelegatedClientIdentityProviderAuthorizer.java#L60-L93","documentation":"BaseDelegatedClientIdentityProviderAuthorizer.handleAuthorizationForService warns and returns false when the registered service's delegated authentication policy (delegatedAuthenticationPolicyEnforcer.execute) rejects the requested identity-provider client name. The provider is thus not allowed for that service even though the service itself is accessible.","triggerScenarios":"A service definition's delegatedAuthenticationPolicy.allowedProviders does not include the clientName being used (or the policy evaluation otherwise fails), evaluated during isDelegatedClientAuthorizedFor in the delegated authentication flow.","commonSituations":"Service JSON allowlists specific providers but the user picked/configured a different (or newly-renamed generated) client name; provider renamed or given an explicit name (see error 553) so allowlist entries no longer match; wildcard/no policy set on another service causing policy enforcer misconfiguration.","solutions":["Add the provider's client name to the service's delegatedAuthenticationPolicy.allowedProviders list in the registered service definition.","Ensure the clientName used matches the allowlist exactly after renaming clients (set explicit client names, update allowlists).","Set allowedProviders to a wildcard/regex if the service should permit all providers."],"exampleFix":"// before: service JSON\n\"delegatedAuthenticationPolicy\": { \"allowedProviders\": [\"SAML2Client\"] }\n// after\n\"delegatedAuthenticationPolicy\": { \"allowedProviders\": [\"SAML2Client\", \"my-oidc\"] }","handlingStrategy":"validation","validationCode":"List<String> allowed = registeredService.getDelegatedAuthenticationPolicy() != null\n    ? registeredService.getDelegatedAuthenticationPolicy().getAllowedProviders() : List.of();\nif (!allowed.isEmpty() && !allowed.contains(clientName)) { /* provider not authorized for this service */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep allowedProviders lists in sync with explicit client names.","Re-check policies after adding or renaming identity providers."],"tags":["pac4j","delegated-authentication","authorization-policy","registered-service"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}