apereo/cas · warning

Cannot find metadata linked to

Error message

Cannot find metadata linked to [{}]

What it means

When CAS builds single-logout URLs for a SAML service, it looks up the SP's metadata entity to find SLO endpoints. If no metadata adaptor/EntityDescriptor exists for the resolved entity id, this warning is logged and the method returns null, meaning no logout URL is produced for that service.

Solutions

1. Confirm the entityID resolves in the configured metadata (open the metadata XML/URL and search for it).
2. Fix the metadata resource/URL in the registered service definition.
3. Clear/refresh the metadata caching resolver so the latest metadata is loaded.
4. If the SP does not support SLO, this is benign — ensure back-channel logout handles the null URL gracefully.

Example fix

// before (service definition)
"metadataLocation": "file:/etc/cas/saml/old-sp.xml"
// after
"metadataLocation": "file:/etc/cas/saml/sp-metadata.xml"

var adaptorRes = SamlRegisteredServiceMetadataAdaptor.get(resolver, service, entityID);
if (adaptorRes.isEmpty()) {
    // skip building logout URL for this service
    return null;
}

When it happens

Trigger: supports()/location() call buildLogoutUrl for a service whose entityID (from the logout request or service config) is absent from the metadata resolver cache for the matched SamlRegisteredService.

Common situations: SP metadata missing or stale; wrong metadata location configured for the service; entityID configured in the service definition differs from the one in metadata; URL-based metadata temporarily unreachable.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Cannot find service provider metadata entity linked to
• Cannot find SLO service in metadata for entity id
• No assertion consumer service could be found for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/6eb882eaaedfaf15. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceLogoutUrlBuilder.java:102

                                                     final WebApplicationService singleLogoutService) {
        LOGGER.trace("Building logout url for SAML service [{}]", registeredService);

        val samlRegisteredService = (SamlRegisteredService) registeredService;
        val extractionResult = SamlIdPServiceAttributeExtractor.extract(registeredService, singleLogoutService);
        val entityID = extractionResult
            .map(pair -> {
                val attribute = pair.getLeft();
                val attributeValue = pair.getRight();
                LOGGER.trace("Located service attribute [{}] with value [{}]", attribute, attributeValue);
                return attribute.getEntityIdFrom(samlRegisteredServiceCachingMetadataResolver, attributeValue);
            })
            .orElseGet(singleLogoutService::getId);
        LOGGER.trace("Located entity id [{}]", entityID);

        val adaptorRes = SamlRegisteredServiceMetadataAdaptor.get(
            samlRegisteredServiceCachingMetadataResolver, samlRegisteredService, entityID);
        if (adaptorRes.isEmpty()) {
            LOGGER.warn("Cannot find metadata linked to [{}]", entityID);
            return null;
        }
        val adaptor = adaptorRes.get();
        for (val binding : this.logoutRequestBindings) {
            var sloService = adaptor.getSingleLogoutService(binding);
            if (sloService != null) {
                return finalizeSingleLogoutUrl(sloService, samlRegisteredService);
            }
        }
        LOGGER.warn("Cannot find SLO service in metadata for entity id [{}]", entityID);
        return null;
    }

    private static @Nullable SingleLogoutUrl finalizeSingleLogoutUrl(final SingleLogoutService sloService, final SamlRegisteredService service) {
        val location = StringUtils.isBlank(sloService.getResponseLocation())
            ? sloService.getLocation()
            : sloService.getResponseLocation();
        if (StringUtils.isNotBlank(location)) {

View on GitHub (pinned to e7288fc434)