{"record":{"id":"ea922d9f9d233ae9","repo":"apereo/cas","slug":"accountexpiredexception","errorCode":null,"errorMessage":"AccountExpiredException","messagePattern":"AccountExpiredException","errorType":"exception","errorClass":"AccountExpiredException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-redis-authentication/src/main/java/org/apereo/cas/redis/RedisAuthenticationHandler.java","lineNumber":45,"sourceCode":"        super(name, principalFactory, order);\n        this.redisTemplate = redisTemplate;\n    }\n\n    @Override\n    protected AuthenticationHandlerExecutionResult authenticateUsernamePasswordInternal(\n        final UsernamePasswordCredential credential,\n        final String originalPassword) throws Throwable {\n        val account = (RedisUserAccount) redisTemplate.opsForValue().get(credential.getUsername());\n        if (account == null) {\n            throw new AccountNotFoundException();\n        }\n        if (!getPasswordEncoder().matches(originalPassword, account.getPassword())) {\n            LOGGER.warn(\"Account password on record for [{}] does not match the given/encoded password\", credential.getId());\n            throw new FailedLoginException();\n        }\n        switch (account.getStatus()) {\n            case DISABLED -> throw new AccountDisabledException();\n            case EXPIRED -> throw new AccountExpiredException();\n            case LOCKED -> throw new AccountLockedException();\n            case MUST_CHANGE_PASSWORD -> throw new AccountPasswordMustChangeException();\n            case OK -> LOGGER.debug(\"Account status is OK\");\n        }\n        val principal = principalFactory.createPrincipal(account.getUsername(), account.getAttributes());\n        return createHandlerResult(credential, principal, new ArrayList<>());\n    }\n}\n","sourceCodeStart":27,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-redis-authentication/src/main/java/org/apereo/cas/redis/RedisAuthenticationHandler.java#L27-L54","documentation":"When the Redis account's Status is EXPIRED, the handler throws AccountExpiredException after successful password verification. Authentication is refused because the account's validity window has lapsed per the stored status.","triggerScenarios":"RedisUserAccount.getStatus() == Status.EXPIRED on the matched account after a successful password check.","commonSituations":"Password or account expiry date passed and a sync job marks status EXPIRED in Redis; expiry not extended after renewal; Redis holds a stale snapshot from before the account was renewed upstream.","solutions":["Extend the account's validity/renewal upstream and re-sync status to OK in Redis","Manually update the RedisUserAccount status to OK if the upstream system is already correct","Review the expiry/sync job schedule so renewals propagate promptly"],"exampleFix":"// before\naccount.setStatus(Status.EXPIRED);\nredisTemplate.opsForValue().set(username, account);\n// after (post-renewal sync)\naccount.setStatus(Status.OK);\nredisTemplate.opsForValue().set(username, account);","handlingStrategy":"validation","validationCode":"RedisUserAccount acct = (RedisUserAccount) redisTemplate.opsForValue().get(username);\nif (acct != null && acct.getStatus() == Status.EXPIRED) {\n    // route user to account renewal flow before login\n}","typeGuard":"boolean isActiveAccount(RedisUserAccount a) { return a != null && a.getStatus() == Status.OK; }","tryCatchPattern":"try {\n    authHandler.authenticate(credential);\n} catch (AccountExpiredException e) {\n    // account-expired messaging / renewal link\n}","preventionTips":["Automate renewal -> status re-sync","Alert on accounts approaching expiry","Avoid long-lived Redis snapshots of expiry state"],"tags":["redis","account-expired","authentication","cas"],"backgroundTag":"account-expired","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}