{"record":{"id":"fe39cae905ef6f19","repo":"apereo/cas","slug":"unable-to-determine-authentication-from-the-reques","errorCode":null,"errorMessage":"Unable to determine authentication from the request context","messagePattern":"Unable to determine authentication from the request context","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-aup-core/src/main/java/org/apereo/cas/aup/BaseAcceptableUsagePolicyRepository.java","lineNumber":36,"sourceCode":" * @author Misagh Moayyed\n * @since 4.2.0\n */\n@Slf4j\n@RequiredArgsConstructor(access = AccessLevel.PROTECTED)\npublic abstract class BaseAcceptableUsagePolicyRepository implements AcceptableUsagePolicyRepository {\n    @Serial\n    private static final long serialVersionUID = 1883808902502739L;\n\n    /**\n     * Acceptable usage policy properties.\n     */\n    protected final AcceptableUsagePolicyProperties aupProperties;\n    \n    @Override\n    public AcceptableUsagePolicyStatus verify(final RequestContext requestContext) throws Throwable {\n        val authentication = WebUtils.getAuthentication(requestContext);\n        if (authentication == null) {\n            throw new AuthenticationException(\"Unable to determine authentication from the request context\");\n        }\n        val principal = authentication.getPrincipal();\n\n        if (isUsagePolicyAcceptedBy(principal)) {\n            LOGGER.debug(\"Acceptable usage policy has been accepted by [{}]\", principal.getId());\n            return AcceptableUsagePolicyStatus.accepted(principal);\n        }\n\n        LOGGER.info(\"Acceptable usage policy has not been accepted by [{}]\", principal.getId());\n        return AcceptableUsagePolicyStatus.denied(principal);\n    }\n\n    /**\n     * Determines whether the user has accepted the usage policy.\n     * Looks into the attributes collected by the principal to find the correct attribute, specified in settings..\n     * If the attribute contains {@code true}, then the policy is determined as accepted.\n     *\n     * @param principal the principal","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-aup-core/src/main/java/org/apereo/cas/aup/BaseAcceptableUsagePolicyRepository.java#L18-L54","documentation":"BaseAcceptableUsagePolicyRepository.verify() retrieves the current Authentication from the webflow request context to check the principal's AUP acceptance. With no authentication in scope it cannot evaluate the policy and throws AuthenticationException.","triggerScenarios":"The AUP webflow action/repositories' verify() runs during a flow where WebUtils.getAuthentication(requestContext) is null — e.g. AUP verification invoked outside the authenticated portion of the login flow, after session/context loss, or in a custom flow that skipped authentication.","commonSituations":"Custom webflow states calling the AUP repository before authentication completes; AUP verification triggered via a direct endpoint without flow authentication; expired sessions resuming a stale execution; ordering issues where the AUP state was placed before credential validation.","solutions":["Move the AUP verification state after authentication in the login webflow so an Authentication exists in the context","Ensure the user completes a fresh login (valid flow execution) rather than reusing an expired session","In custom integrations, populate the context first via WebUtils.putAuthentication(context, authentication) before calling verify()","Check any custom AcceptableUsagePolicyRepository overrides that call verify() prematurely"],"exampleFix":"// before\nval status = aupRepository.verify(requestContext);\n// after\nif (WebUtils.getAuthentication(requestContext) == null) {\n    throw new IllegalStateException(\"AUP verification requires an authenticated principal; place AUP state after authentication\");\n}\nval status = aupRepository.verify(requestContext);","handlingStrategy":"type-guard","validationCode":"if (WebUtils.getAuthentication(requestContext) == null) {\n    throw new IllegalStateException(\"AUP state must run after authentication\");\n}","typeGuard":"Authentication authn = WebUtils.getAuthentication(requestContext);\nboolean readyForAupCheck = authn != null && authn.getPrincipal() != null;","tryCatchPattern":"try {\n    return aupRepository.verify(requestContext);\n} catch (AuthenticationException e) {\n    logger.warn(\"AUP verification without authentication; restart login flow\");\n    return AcceptableUsagePolicyStatus.denied(principal-less flow);\n}","preventionTips":["Place AUP webflow states after credential authentication","Never invoke verify() from unauthenticated endpoints","Populate the request context with Authentication in custom flows before AUP checks"],"tags":["aup","webflow","authentication"],"backgroundTag":"authentication-required","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}