Assertion will skip assigning/generating a nameId based on…

Error message

Assertion will skip assigning/generating a nameId based on service [{}]

What it means

The registered SAML service is configured to skip generating an assertion NameID, so the subject builder deliberately returns null instead of invoking the NameID builder. This is an expected, warning-level outcome used for SPs that do not require a <NameID> in the assertion subject (typically relying on SubjectConfirmation only).

Solutions

Set skipGeneratingAssertionNameId = false in the registered SAML service if the SP expects a NameID
Confirm the SP tolerates assertions without a NameID before leaving the flag enabled
Review the service definition configuration in the management console or JSON registry for the flag

Example fix

// before (service JSON)
"skipGeneratingAssertionNameId": true
// after
"skipGeneratingAssertionNameId": false

Defensive patterns

Strategy: validation

Validate before calling

// Check the flag before expecting a NameID in the assertion
if (registeredService.isSkipGeneratingAssertionNameId()) {
    LOGGER.info("SP [{}] will receive assertions without a NameID", registeredService.getServiceId());
}

Try / catch

try {
    val nameId = getNameIdForService(context);
    if (nameId == null) {
        // expected when skipGeneratingAssertionNameId is enabled
        LOGGER.debug("NameID intentionally omitted");
    }
} catch (Exception e) {
    LOGGER.error("Subject building failed", e);
}

Prevention

Only set skipGeneratingAssertionNameId for SPs verified to work without a NameID
Document the flag's effect in your service registry notes
Re-test SP integrations after toggling the flag
Audit service definitions for unexpected flag values

When it happens

Trigger: subjectNameId/subjectConfNameId -> getNameIdForService sees context.getRegisteredService().isSkipGeneratingAssertionNameId() == true and returns null without building a NameID.

Common situations: Service definition has skipGeneratingAssertionNameId enabled accidentally; SP actually requires a NameID but admin enabled the flag; copying service config templates that set the flag.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/fa68f585710236e3. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/subject/SamlProfileSamlSubjectBuilder.java:93

        val finalSubjectNameId = encryptNameIdIfNecessary(subjectNameId, context);
        val finalSubjectConfigNameId = encryptNameIdIfNecessary(subjectConfNameId, context);

        val entityId = casProperties.getAuthn().getSamlIdp().getCore().getEntityId();
        val subjectConfirmation = newSubjectConfirmation(
            registeredService.isSkipGeneratingSubjectConfirmationRecipient() ? null : location,
            notOnOrAfter,
            getInResponseTo(context.getSamlRequest(), entityId, registeredService.isSkipGeneratingSubjectConfirmationInResponseTo()),
            registeredService.isSkipGeneratingSubjectConfirmationNotBefore() ? null : ZonedDateTime.now(ZoneOffset.UTC),
            registeredService.isSkipGeneratingSubjectConfirmationAddress() ? null : InetAddressUtils.getByName(location));
        
        val subject = newSubject(finalSubjectNameId, finalSubjectConfigNameId, subjectConfirmation);
        LOGGER.debug("Created SAML subject [{}]", subject);
        return subject;
    }

    private SAMLObject getNameIdForService(final SamlProfileBuilderContext context) throws Exception {
        if (context.getRegisteredService().isSkipGeneratingAssertionNameId()) {
            LOGGER.warn("Assertion will skip assigning/generating a nameId based on service [{}]", context.getRegisteredService());
            return null;
        }
        return ssoPostProfileSamlNameIdBuilder.build(context);
    }

    private SAMLObject encryptNameIdIfNecessary(final SAMLObject subjectNameId,
                                                final SamlProfileBuilderContext context) {
        if (!(subjectNameId instanceof EncryptedID)
            && subjectNameId instanceof final NameID nameId
            && NameIDType.ENCRYPTED.equalsIgnoreCase(nameId.getFormat())) {
            return samlObjectEncrypter.encode(nameId, context.getRegisteredService(), context.getAdaptor());
        }
        return subjectNameId;
    }
}

View on GitHub (pinned to e7288fc434)