{"record":{"id":"e71c9bc153d0312c","repo":"apereo/cas","slug":"servicemanagement-unauthorized-service-access-se","errorCode":null,"errorMessage":"ServiceManagement: Unauthorized Service Access. Service [%s] is not enabled in the CAS service registry.","messagePattern":"ServiceManagement: Unauthorized Service Access\\. Service \\[(.+?)\\] is not enabled in the CAS service registry\\.","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-validation-core/src/main/java/org/apereo/cas/web/AbstractServiceValidateController.java","lineNumber":70,"sourceCode":" * @author Misagh Moayyed\n * @since 3.0.0\n */\n@Slf4j\n@Getter\n@RequiredArgsConstructor(access = AccessLevel.PROTECTED)\npublic abstract class AbstractServiceValidateController extends AbstractDelegateController {\n    private final ServiceValidateConfigurationContext serviceValidateConfigurationContext;\n\n    private static void verifyRegisteredServiceProperties(final RegisteredService registeredService, final Service service) {\n        if (registeredService == null) {\n            val msg = String.format(\"Service [%s] is not found in service registry.\", service.getId());\n            LOGGER.warn(msg);\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            val msg = String.format(\"ServiceManagement: Unauthorized Service Access. \"\n                + \"Service [%s] is not enabled in the CAS service registry.\", service.getId());\n            LOGGER.warn(msg);\n            throw UnauthorizedServiceException.denied(msg);\n        }\n    }\n\n    protected Ticket handleProxyGrantingTicketDelivery(final String serviceTicketId, final Credential credential) throws Throwable {\n        val serviceTicket = serviceValidateConfigurationContext.getTicketRegistry().getTicket(serviceTicketId, ServiceTicket.class);\n        val authenticationResult = serviceValidateConfigurationContext.getAuthenticationSystemSupport()\n            .finalizeAuthenticationTransaction(serviceTicket.getService(), credential);\n        val proxyGrantingTicket = serviceValidateConfigurationContext.getCentralAuthenticationService()\n            .createProxyGrantingTicket(serviceTicketId, authenticationResult);\n        LOGGER.debug(\"Generated proxy-granting ticket [{}] off of service ticket [{}] and credential [{}]\",\n            proxyGrantingTicket.getId(), serviceTicketId, credential);\n        return proxyGrantingTicket;\n    }\n\n    @Override\n    public ModelAndView handleRequestInternal(final HttpServletRequest request,\n                                              final HttpServletResponse response) throws Exception {","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-validation-core/src/main/java/org/apereo/cas/web/AbstractServiceValidateController.java#L52-L88","documentation":"The service is registered but its access strategy says service access is not allowed (entry disabled, expired, or otherwise restricted), so verifyRegisteredServiceProperties throws UnauthorizedServiceException.denied with this message. This is an explicit policy denial, not a missing record.","triggerScenarios":"verifyRegisteredServiceProperties (called from getServiceCredentialsFromRequest during ticket validation) calls registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service) and it returns false for the matched registered service.","commonSituations":"Service registry entry toggled to disabled (enabled=false); entry's validFrom/validUntil date window expired; authorized to proxy / allowed attribute policies blocking access after a registry edit or bulk import.","solutions":["Open the service in the management console (or its JSON entry) and set enabled=true, or fix the access strategy constraints.","Check validFrom/validUntil dates on the registry entry and extend or correct them.","Review the entry's access strategy (e.g. DefaultRegisteredServiceAccessStrategy, unauthorized redirect settings) for conditions that deny this particular service/principal."],"exampleFix":"// before\n{\n  \"serviceId\": \"^https://myapp\\.example\\.org/.*\",\n  \"id\": 10000001,\n  \"accessStrategy\": { \"@class\": \"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy\", \"enabled\": false }\n}\n\n// after\n{\n  \"serviceId\": \"^https://myapp\\.example\\.org/.*\",\n  \"id\": 10000001,\n  \"accessStrategy\": { \"@class\": \"org.apereo.cas.services.DefaultRegisteredServiceAccessStrategy\", \"enabled\": true }\n}","handlingStrategy":"validation","validationCode":"// before validating tickets, check the registry entry's access strategy\nRegisteredService rs = servicesManager.findServiceBy(service);\nif (rs == null || !rs.getAccessStrategy().isServiceAccessAllowed(rs, service)) {\n    throw new IllegalStateException(\"Service disabled or expired in CAS registry: \" + service.getId());\n}","typeGuard":null,"tryCatchPattern":"try {\n    // validate ticket\n} catch (UnauthorizedServiceException e) {\n    if (e.getMessage().contains(\"not enabled\")) { /* re-enable service or fix validFrom/validUntil */ }\n}","preventionTips":["Keep registry entries enabled=true and validFrom/validUntil ranges covering production windows.","Set expiry alerts for service registry entries with finite validity windows.","After bulk imports, verify each entry's access strategy via the services management API."],"tags":["service-registry","access-strategy","unauthorized-service","ticket-validation"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}