{"record":{"id":"f1922f95188ea84b","repo":"apereo/cas","slug":"failed-to-save-google-authenticator-account","errorCode":null,"errorMessage":"Failed to save google authenticator account","messagePattern":"Failed to save google authenticator account","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/credential/RestGoogleAuthenticatorTokenCredentialRepository.java","lineNumber":254,"sourceCode":"                .method(HttpMethod.POST)\n                .url(rest.getUrl())\n                .headers(headers)\n                .build();\n            response = HttpUtils.execute(exec);\n\n            if (response != null) {\n                val status = HttpStatus.valueOf(response.getCode());\n                if (status.is2xxSuccessful()) {\n                    LOGGER.debug(\"Posted google authenticator account successfully\");\n                    return account;\n                }\n            }\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        } finally {\n            HttpUtils.close(response);\n        }\n        LOGGER.warn(\"Failed to save google authenticator account\");\n        return null;\n    }\n\n    @Override\n    public void deleteAll() {\n        val rest = gauth.getRest();\n        HttpResponse response = null;\n        try {\n            val exec = HttpExecutionRequest.builder()\n                .basicAuthPassword(rest.getBasicAuthPassword())\n                .basicAuthUsername(rest.getBasicAuthUsername())\n                .method(HttpMethod.GET)\n                .url(rest.getUrl())\n                .headers(rest.getHeaders())\n                .build();\n            response = HttpUtils.execute(exec);\n        } finally {\n            HttpUtils.close(response);","sourceCodeStart":236,"sourceCodeEnd":272,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-gauth-core/src/main/java/org/apereo/cas/gauth/credential/RestGoogleAuthenticatorTokenCredentialRepository.java#L236-L272","documentation":"RestGoogleAuthenticatorTokenCredentialRepository.update() posts account changes to the configured REST endpoint. When the HTTP call throws or returns an unexpected response the exception is logged and this warning is emitted, and the method returns null, meaning the save was NOT persisted.","triggerScenarios":"Calling save()/update() when the REST endpoint (cas.authn.mfa.gauth.rest.url) is down, returns a non-success status, rejects the payload, or the connection times out; exceptions inside the try block are swallowed and reduced to this warning.","commonSituations":"REST endpoint misconfigured or unreachable in clustered deployments; endpoint auth (basic auth credentials) missing or wrong; backend service rejects the JSON payload after an API change; network/firewall blocking inter-service calls.","solutions":["Check the surrounding logged stack trace (LoggingUtils.error) for the root cause — connection refused vs HTTP error vs auth failure","Verify cas.authn.mfa.gauth.rest.url and REST endpoint credentials are correct and the endpoint is reachable from CAS (curl it)","Inspect and fix the endpoint's handling of the account payload (method, content type, serialization)","Add health checks/retries on the REST service so transient outages are caught before account updates fail"],"exampleFix":"// before\ncas.authn.mfa.gauth.rest.url=https://otp.internal.example.org/missingEndpoint\n// after\ncas.authn.mfa.gauth.rest.url=https://otp.internal.example.org/api/accounts","handlingStrategy":"retry","validationCode":"// verify the REST endpoint before issuing account updates\nboolean up = HttpUtils.areSettingsHttpsOnlyOk(...) /* or */ curl -fsS $CAS_GAUTH_REST_URL/health;","typeGuard":null,"tryCatchPattern":"try {\n    result = repository.save(account);\n    if (result == null) { /* save silently failed — inspect logs and retry */ }\n} catch (Exception e) {\n    // network/endpoint failure: retry with backoff\n}","preventionTips":["Health-check the REST endpoint in deployment pipelines","Validate cas.authn.mfa.gauth.rest.url and credentials","Treat a null return from save() as failure even though no exception is thrown","Monitor inter-service connectivity/firewall rules"],"tags":["rest","http","network","otp"],"backgroundTag":"http-request-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}