OIDC Delegated regression on 7.3 => Delegated client identifier [] is undefined in request URL

[Louis Chanouha]

Hello,
I'm currently upgrading my CAS from 7.2 to 7.3.

I have an regression on my PAC4j delegated OIDC.

Did anyone experienced this issue or is aware of changes on 7.3 ? I did'nt see linked changes on CAS 7.3 RC's changelog

Thanks :)

2026-02-19 11:16:56,739 DEBUG [org.apereo.cas.web.flow.actions.DelegatedClientAuthenticationRedirectAction] - <Redirecting client [FranceConnect] based on identifier [TST-1-****************TBp-pP6-7f3c2b761bc8]>
2026-02-19 11:16:56,740 DEBUG [org.apereo.cas.web.flow.actions.DelegatedClientAuthenticationRedirectAction] - <Redirecting to [https://fcp-low.integ01.dev-franceconnect.fr/api/v2/authorize?scope=openid%20given_name%20family_name%20birthdate%20birthplace%20birthcountry%20preferred_username&acr_values=eidas1&claims=%7B%22id_token%22%3A%7B%22amr%22%3A%7B%22essential%22%3Atrue%7D%7D%7D&response_type=code&redirect_uri=https%3A%2F%2Fcas-dev.fqdn.fr%2Fcas%2Flogin%2FFranceConnect&state=12345&nonce=6789] via client [FranceConnect]>
// LOGIN //
2026-02-19 11:17:08,596 DEBUG [org.apereo.cas.web.flow.controller.DefaultDelegatedAuthenticationNavigationController] - <Received response from client [FranceConnect]; Redirecting to [https://cas-dev.fqdn.fr/cas/login?code=oBJ74fVZvkezMQSdu5L7NNVUoJwhgcwzZlOOryIEMXg&state=999&iss=https%3A%2F%2Ffcp-low.integ01.dev-franceconnect.fr%2Fapi%2Fv2&client_name=FranceConnect]>
2026-02-19 11:17:08,667 DEBUG [org.apereo.cas.web.flow.CasFlowHandlerMapping] - <Mapped to [FlowHandlerMapping.DefaultFlowHandler@24f51b6c]>
2026-02-19 11:17:08,672 DEBUG [org.apereo.cas.web.flow.DefaultDelegatedClientAuthenticationWebflowManager] - <Located delegated client identifier []>
2026-02-19 11:17:08,672 INFO [org.apereo.cas.web.flow.DefaultDelegatedClientAuthenticationWebflowManager] - <Delegated client identifier [] is undefined in request URL [https://cas-dev.fqdn.fr/cas/login?code=oBJ74fVZvkezMQSdu5L7NNVUoJwhgcwzZlOOryIEMXg&state=999&iss=https%3A%2F%2Ffcp-low.integ01.dev-franceconnect.fr%2Fapi%2Fv2&client_name=FranceConnect]>
2026-02-19 11:17:08,673 DEBUG [org.apereo.cas.authentication.principal.DefaultDelegatedAuthenticationCredentialExtractor] - <Fetching credentials from delegated client [OidcClient(super=IndirectClient(super=BaseClient(name=FranceConnect, authorizationGenerators=[], credentialsExtractor=org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor@6fae47b2, authenticator=org.pac4j.oidc.credentials.authenticator.OidcAuthenticator@419b23f3, profileCreator=InitializableObject(initialized=false, maxAttempts=3, nbAttempts=0, lastAttempt=null, minTimeIntervalBetweenAttemptsInMilliseconds=5000), customProperties={autoRedirectType=NONE, cssClass=franceconnect, displayName=Se connecter avec France Connect}, profileFactoryWhenNotAuthenticated=null, multiProfile=false, saveProfileInSession=true, config=null), callbackUrl=https://cas-dev.fqdn.fr/cas/login, urlResolver=org.pac4j.core.http.url.DefaultUrlResolver@61f7cde6, callbackUrlResolver=org.pac4j.core.http.callback.PathParameterCallbackUrlResolver@42780018, ajaxRequestResolver=org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@f94a4b5, redirectionActionBuilder=org.pac4j.oidc.redirect.OidcRedirectionActionBuilder@71eb34d1, logoutProcessor=org.pac4j.oidc.logout.processor.OidcLogoutProcessor@2e2c5ff7, logoutActionBuilder=org.pac4j.oidc.logout.OidcLogoutActionBuilder@2cd6e2ea, checkAuthenticationAttempt=true), configuration=OidcConfiguration(clientId=377f9c3fd633bb7f85362d6b97aea642101916336709c051c3d0816fd83e4e0e, discoveryURI=https://fcp-low.integ01.dev-franceconnect.fr/api/v2/.well-known/openid-configuration, scope=openid,given_name,family_name,birthdate,birthplace,birthcountry,preferred_username, customParams={claims={"id_token": {"amr": {"essential": true } } }, acr_values=eidas1}, clientAuthenticationMethod=null, supportedClientAuthenticationMethods=null, privateKeyJWTClientAuthnMethodConfig=null, useNonce=true, disablePkce=true, pkceMethod=null, preferredJwsAlgorithm=ES256, maxAge=null, maxClockSkew=5, resourceRetriever=org.pac4j.oidc.config.OidcConfiguration$OidcResourceRetriever@6cd4ac9, responseType=code, responseMode=null, logoutUrl=null, connectTimeout=5000, readTimeout=5000, withState=true, mappedClaims={}, stateGenerator=org.pac4j.core.util.generator.RandomValueGenerator@2ea8bb7d, codeVerifierGenerator=org.pac4j.core.util.generator.RandomValueGenerator@62378ab8, valueRetriever=org.pac4j.oidc.util.SessionStoreValueRetriever@79edf5a6, expireSessionWithToken=false, tokenExpirationAdvance=0, allowUnsignedIdTokens=false, includeAccessTokenClaimsInProfile=false, sslSocketFactory=sun.security.ssl.SSLSocketFactoryImpl@188d92f9, callUserInfoEndpoint=true, hostnameVerifier=org.apache.hc.client5.http.ssl.DefaultHostnameVerifier@151a6350, opMetadataResolver=InitializableObject(initialized=true, maxAttempts=3, nbAttempts=1, lastAttempt=1771499816004, minTimeIntervalBetweenAttemptsInMilliseconds=5000), logoutValidation=true))]>
2026-02-19 11:17:08,676 DEBUG [org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor] - <Authentication response successful>
2026-02-19 11:17:08,780 DEBUG [org.pac4j.core.resource.SpringResourceLoader] - <lastModified: 0 / newLastModified: 0 -> hasChanged: false>
2026-02-19 11:17:08,781 DEBUG [org.pac4j.oidc.client.OidcClient] - <no credentials and profile returned -> remember the authentication attempt>
2026-02-19 11:17:08,781 DEBUG [org.pac4j.oidc.client.OidcClient] - <save authentication attempt in session>
2026-02-19 11:17:08,781 DEBUG [org.apereo.cas.ticket.registry.AbstractMapBasedTicketRegistry] - <Putting ticket [TST-844ad5a8-c34c-46ef-9dc0-dd2242cfa147] in registry.>
2026-02-19 11:17:08,784 WARN [org.apereo.cas.util.function.FunctionUtils] - <State cannot be determined>
org.pac4j.oidc.exceptions.OidcMissingSessionStateException: State cannot be determined
        at org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor.lambda$extract$0(OidcCredentialsExtractor.java:141)
        at java.base/java.util.Optional.orElseThrow(Optional.java:403)
        at org.pac4j.oidc.credentials.extractor.OidcCredentialsExtractor.extract(OidcCredentialsExtractor.java:141)
        at org.pac4j.core.client.BaseClient.getCredentials(BaseClient.java:80)
        at org.apereo.cas.authentication.principal.DefaultDelegatedAuthenticationCredentialExtractor.lambda$getCredentialsFromDelegatedClient$2(DefaultDelegatedAuthenticationCredentialExtractor.java:50)
        at org.apereo.cas.util.function.FunctionUtils.lambda$doAndHandle$12(FunctionUtils.java:425)
        at org.apereo.cas.authentication.principal.DefaultDelegatedAuthenticationCredentialExtractor.getCredentialsFromDelegatedClient(DefaultDelegatedAuthenticationCredentialExtractor.java:54)
        at org.apereo.cas.authentication.principal.DefaultDelegatedAuthenticationCredentialExtractor.extract(DefaultDelegatedAuthenticationCredentialExtractor.java:30)
        at org.apereo.cas.web.flow.actions.DelegatedClientAuthenticationAction.lambda$populateContextWithClientCredential$6(DelegatedClientAuthenticationAction.java:255)
        at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
        at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
        at java.base/java.util.AbstractList$RandomAccessSpliterator.tryAdvance(AbstractList.java:708)
        at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:129)
        at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:527)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:513)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
        at java.base/java.util.stream.FindOps$FindOp.evaluateSequential(FindOps.java:150)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
        at java.base/java.util.stream.ReferencePipeline.findFirst(ReferencePipeline.java:647)

Actual working flow on 7.2

2026-02-19 11:09:55,610 DEBUG [org.apereo.cas.ticket.registry.AbstractMapBasedTicketRegistry] - <Putting ticket [TST-dbf06ff0-3d72-46e3-9f71-4d848732222b] in registry.>
2026-02-19 11:09:55,610 DEBUG [org.apereo.cas.web.flow.DefaultDelegatedClientAuthenticationWebflowManager] - <Located delegated client identifier [TST-1-****************I1iEQpe-9aae8cc0bfc1]>
2026-02-19 11:09:55,611 DEBUG [org.apereo.cas.web.flow.DefaultDelegatedClientAuthenticationWebflowManager] - <Located delegated authentication client identifier as [TST-1-****************I1iEQpe-9aae8cc0bfc1]>
2026-02-19 11:09:55,611 DEBUG [org.apereo.cas.web.flow.DefaultDelegatedClientAuthenticationWebflowManager] - <Removing delegated client identifier [TST-1-****************I1iEQpe-9aae8cc0bfc1] from registry>

2026-02-19 11:09:55,612 DEBUG [org.apereo.cas.ticket.registry.AbstractTicketRegistry] - 

[Louis Chanouha]

Looks like it's broken since 7.3.4, 7.3.3 is fine, I continue looking into code

[Louis Chanouha]

I found the commit  which changed pac4j session behaviour:
https://github.com/apereo/cas/commit/2fbee582903a60dcfd5522c95f50ab2e728d1312

Le jeudi 19 février 2026 à 13:27:33 UTC+1, Louis Chanouha a écrit :

[Matthew Gordon]

Hello Louis,

Did you ever resolve this issue?

Thank you,

Matt

[Jérôme LELEU]

Hi,

The "state cannot be determined" error is generally a good hint that there is a problem with the session used by pac4j.

By default, it is clustered and you should track the "DISSessionXXX" cookie: is it set on the right path? Does it change during the login process?

Thanks.

Best regards,

Jérôme

--
- Website: https://apereo.github.io/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/ef472eb7-a556-4aeb-9727-894ef13ee369n%40apereo.org.

[Matthew Gordon]

In my case, despite getting warnings on startup that the settings are "deprecated and scheduled to be removed", the are in fact needed...

2026-07-15 15:35:52,455 WARN [org.apereo.cas.metadata.CasConfigurationPropertiesValidator] - <
The following settings are deprecated and scheduled to be removed in future releases of CAS. Please review the replacement settings where applicable and update your configuration accordingly.

- Deprecated Property: cas.authn.pac4j.core.session-replication.cookie.crypto = N/A
- Deprecated Property: cas.authn.pac4j.core.session-replication.cookie = N/A
- Deprecated Property: cas.authn.pac4j.core.session-replication = N/A>

You must still have these settings populated, or you get the error I posted when trying to use Entra, and probably other delegated auth providers...

cas.authn.pac4j.core.session-replication.cookie.crypto.signing.key=
cas.authn.pac4j.core.session-replication.cookie.crypto.encryption.key=

Thank you,

Matt

[Louis Chanouha]

Hello,

The fix on config should be an xx.xx.cookie.secure = true, but I patched the code (revert of commit  https://github.com/apereo/cas/commit/2fbee582903a60dcfd5522c95f50ab2e728d1312) due to lack of time.

Louis

--

Louis CHANOUHA

louis.c...@gmail.com