Application Not Authorized to Use CAS The application you attempted to authenticate to is not authorized to use CAS

Question

We are using single sign on solution set up using CAS server( deployed on tomcat). The login was working seamless few days back and all of a sudden its says "

Problem Application Not Authorized to Use CAS The application you attempted to authenticate to is not authorized to use CAS

After user login, the user is successfully authenticated in the backend (in the logs we can see its authenticated), but after login the user will redirect to /oidc/token and then to /profile. Now its failing in the /profile redirection.

What I tried We tried checking the catalina.log and it says used authenticated successfully. We have checked the regexregisteredservice.json file located in /etc/cas/config and there is no change.

The same is working in UAT environement.

Assumptions Few days back we have updated our SSL certificate in the website. Does it effect the CAS services ?

This is the regexregisteredservice.json file sample

{ @class: org.apereo.cas.services.RegexRegisteredService serviceId: https://host:port/oauth2.0/callbackAuthorize.* name: RegexRegisteredService id: 2588160372902752768 description: OAuth Authentication Callback Request URL proxyPolicy: {

Expected Result:

After login user will redirect to /oidc/token and then to /profile

Its wokring in UAT but the problem in production(clustered version, deployed on tomcat)

Solution

I solved issue myself, The issue was with the serviceId not mapped correctly in the client table of the CAS database.

It took two weeks to understand the complete CAS system and resolve the issue. But Someone having the same issue can directly follow the below steps (Assuming CAS 5.1 version deployed on tomcat +linux)

• Check your .json files placed under /etc/cas/services
• Check your .jwks files places under /etc/cas/jwks folder
• Check the clientId and ClientSecret matches in .json , .jwks and in CAS Database- Client table
• Check the serviceID mapped in .json,.jwks and in your CAS Database,client table

All the best.