{"record":{"id":"fd6fca47fba67405","repo":"apereo/cas","slug":"provided-regular-expression-or-ip-netmask-doe","errorCode":null,"errorMessage":"Provided regular expression or IP/netmask [{}] does not match [{}]","messagePattern":"Provided regular expression or IP/netmask \\[(.+?)\\] does not match \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-webconfig/src/main/java/org/apereo/cas/web/security/authentication/IpAddressAuthorizationManager.java","lineNumber":43,"sourceCode":"@Slf4j\n@RequiredArgsConstructor\npublic class IpAddressAuthorizationManager implements AuthorizationManager<RequestAuthorizationContext> {\n    private final CasConfigurationProperties casProperties;\n\n    private final ActuatorEndpointProperties properties;\n\n    @Override\n    public @Nullable AuthorizationResult authorize(final @NonNull Supplier<? extends Authentication> authentication,\n                                                   final RequestAuthorizationContext context) {\n        val remoteAddr = StringUtils.defaultIfBlank(\n            context.getRequest().getHeader(casProperties.getAudit().getEngine().getAlternateClientAddrHeaderName()),\n            context.getRequest().getRemoteAddr());\n\n        val granted = properties.getRequiredIpAddresses()\n            .stream()\n            .anyMatch(pattern -> RegexUtils.matchesIpAddress(pattern, remoteAddr));\n        if (!granted) {\n            LOGGER.warn(\"Provided regular expression or IP/netmask [{}] does not match [{}]\",\n                properties.getRequiredIpAddresses(), remoteAddr);\n        }\n        return new AuthorizationDecision(granted);\n    }\n}\n","sourceCodeStart":25,"sourceCodeEnd":49,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-webconfig/src/main/java/org/apereo/cas/web/security/authentication/IpAddressAuthorizationManager.java#L25-L49","documentation":"CAS's Spring Security IpAddressAuthorizationManager denied the request because the client's remote address matched none of the configured required IP addresses, regexes, or CIDR/netmask patterns. It is a warn-level log plus an AuthorizationDecision(granted=false), not an exception.","triggerScenarios":"authorize() is invoked for a request whose getRemoteAddr() does not match any entry of properties.getRequiredIpAddresses() as evaluated by RegexUtils.matchesIpAddress (plain IP, regex, or IP/netmask).","commonSituations":"Admin console restricted with cas.monitor or webconfig required-ip-addresses but the operator connects through a load balancer/proxy so the remote addr is the proxy IP; IPv6 vs IPv4 formatting mismatch; netmask written with wrong syntax; whitelist missing the developer's VPN address.","solutions":["Add the actual remote address (check the logged [{}] value) to the requiredIpAddresses list","If behind a proxy, configure CAS to trust X-Forwarded-For so getRemoteAddr() yields the real client IP","Normalize address family (IPv4 vs IPv6) in the whitelist to match what the servlet reports","Correct netmask/CIDR syntax of the configured pattern and redeploy"],"exampleFix":"// before\ncas.webconfig.required-ip-addresses=127.0.0.1\n// after (proxy/LB or LAN access)\ncas.webconfig.required-ip-addresses=127.0.0.1,10.0.0.0/8,::1","handlingStrategy":"validation","validationCode":"var allowed = properties.getRequiredIpAddresses().stream().anyMatch(p -> RegexUtils.matchesIpAddress(p, request.getRemoteAddr()));\nif (!allowed) { /* request will be denied */ }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whitelist the LB/proxy address too, or trust X-Forwarded-For","Test patterns with both IPv4 and IPv6 forms of the client address","Log the effective remote address when diagnosing access denials"],"tags":["ip-restriction","access-control","spring-security"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}