{"record":{"id":"ffe7930a44aa98d9","repo":"apereo/cas","slug":"service-s-is-not-found-in-service-registry","errorCode":null,"errorMessage":"Service [%s] is not found in service registry.","messagePattern":"Service \\[(.+?)\\] is not found in service registry\\.","errorType":"exception","errorClass":"UnauthorizedServiceException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/BaseServiceAuthorizationCheckAction.java","lineNumber":41,"sourceCode":" */\n@Slf4j\n@RequiredArgsConstructor(access = AccessLevel.PROTECTED)\npublic abstract class BaseServiceAuthorizationCheckAction extends BaseCasWebflowAction {\n    private final ServicesManager servicesManager;\n\n    private final AuthenticationServiceSelectionPlan authenticationRequestServiceSelectionStrategies;\n\n    @Override\n    protected @Nullable Event doExecuteInternal(final RequestContext context) {\n        val serviceInContext = WebUtils.getService(context);\n        val service = FunctionUtils.doUnchecked(() -> authenticationRequestServiceSelectionStrategies.resolveService(serviceInContext));\n        if (service == null) {\n            return success();\n        }\n        val registeredService = servicesManager.findServiceBy(service);\n        if (registeredService == null) {\n            val msg = String.format(\"Service [%s] is not found in service registry.\", service.getId());\n            LOGGER.warn(msg);\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        if (!registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            val msg = String.format(\"Service Management: Unauthorized Service Access. \"\n                + \"Service [%s] is not allowed access via the service registry.\", service.getId());\n            LOGGER.warn(msg);\n            WebUtils.putUnauthorizedRedirectUrlIntoFlowScope(context,\n                registeredService.getAccessStrategy().getUnauthorizedRedirectUrl());\n            throw UnauthorizedServiceException.denied(msg);\n        }\n        val delegatedPolicy = registeredService.getAccessStrategy().getDelegatedAuthenticationPolicy();\n        WebUtils.putCasLoginFormViewable(context, delegatedPolicy == null || !delegatedPolicy.isExclusive());\n        return success();\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":57,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-actions-core/src/main/java/org/apereo/cas/web/flow/BaseServiceAuthorizationCheckAction.java#L23-L57","documentation":"BaseServiceAuthorizationCheckAction (webflow) resolves the incoming service in the ServicesManager; if no registered service matches, it throws UnauthorizedServiceException.denied('Service [%s] is not found in service registry.'). CAS refuses to process login flows for services that are not registered.","triggerScenarios":"A login/validation request arrives with a service URL that matches no registeredService pattern (findServiceBy returns null); also triggered when the service registry is empty or failed to load.","commonSituations":"Application's callback URL changed (port, path, protocol) and no registry entry matches; service registry backend (JSON dir, LDAP, Mongo) unreachable or empty; wildcard eval-type mismatch (exact vs regex); typo in serviceId pattern.","solutions":["Register the service (or fix its serviceId regex) so findServiceBy matches the exact incoming URL","Verify the service registry backend is populated and reachable; check the JSON directory/LDAP config","Inspect cas.log for service-registry load warnings at startup","If testing locally, add an entry matching the exact URL (e.g. ^https://localhost:8443/app/.*$)"],"exampleFix":"// before\n\"serviceId\": \"^https://app.example.org:8080/login\"\n// after (client now runs on 8443)\n\"serviceId\": \"^https://app.example.org:8443/login\"","handlingStrategy":"validation","validationCode":"// Client-side precheck: ensure your service URL is registered\nRegisteredService rs = servicesManager.findServiceBy(service);\nif (rs == null) {\n    throw new IllegalStateException(\"Register service first: \" + service.getId());\n}","typeGuard":null,"tryCatchPattern":"try {\n    flow.exec(authorizationCheck);\n} catch (UnauthorizedServiceException e) {\n    logger.error(\"Unregistered service: {}\", e.getMessage());\n    // show 'service not allowed' page or register the service\n}","preventionTips":["Treat serviceId patterns as code: review any URL change of the app","Monitor service-registry backend availability and load errors","Use regex serviceIds tolerant of harmless URL variations (ports, trailing slashes)","Add startup checks that critical services resolve via findServiceBy"],"tags":["service-registry","unauthorized-service","webflow"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}