apereo/cas · warning

Cannot find service provider metadata entity linked to

Error message

Cannot find service provider metadata entity linked to [{}]

What it means

During SAML single logout, CAS resolves the issuing SP's SAML metadata to determine how to respond. If the metadata resolver cache has no entity descriptor matching the logout request's issuer, this warning is logged and the strategy returns null, aborting the logout response.

Solutions

1. Verify the entityID in the incoming LogoutRequest exactly matches an entity in the configured metadata for the service.
2. Refresh the metadata: check the metadata URL is reachable and valid, or update the local metadata resource.
3. Increase metadata cache expiry or clear the metadata resolver cache so stale/absent entries are refetched.
4. Use the /idp/metadata or debug logging (SamlRegisteredServiceMetadataAdaptor) to list available entity ids.
5. If the SP no longer participates in SLO, treat as expected and ensure back-channel logout silently ignores null.

Example fix

// before
cas.authn.saml-idp.metadata.location=file:/etc/cas/saml/sp-metadata.xml
// after (metadata file updated to include the SP entity)
cas.authn.saml-idp.metadata.location=file:/etc/cas/saml/sp-metadata-updated.xml

var adaptor = SamlRegisteredServiceMetadataAdaptor.get(resolver, service, issuer);
if (adaptor.isEmpty()) {
    LOGGER.warn("No metadata for issuer {} — skipping SLO response", issuer);
    return;
}

When it happens

Trigger: handle() receives a SAML LogoutRequest whose issuer entityID is not present in the metadata of the matched SamlRegisteredService — e.g. wrong entity id configured in the service definition, metadata file/URL missing that entity, metadata expired/refreshed out, or federation filter excluding it.

Common situations: Metadata aggregation errors at startup; SP changed its entityID; service regex matched metadata aggregate that lacks the specific entity; cached stale metadata in the resolver cache; typo in service metadata location.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Cannot find metadata linked to
• Cannot find SLO service in metadata for entity id
• No assertion consumer service could be found for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/51d11b4672dae5fd. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutRedirectionStrategy.java:83

                && samlRegisteredService.isLogoutResponseEnabled()
                && sloRequest != null
                && !async;
        }
        return false;
    }

    @Override
    public LogoutRedirectionResponse handle(final HttpServletRequest request, final HttpServletResponse response) throws Exception {
        val samlRegisteredService = (SamlRegisteredService) WebUtils.getRegisteredService(request);
        val samlLogoutRequest = getLogoutRequest(request).orElseThrow();

        val logoutRequestIssuer = SamlIdPUtils.getIssuerFromSamlObject(samlLogoutRequest);
        val adapterResult = SamlRegisteredServiceMetadataAdaptor.get(
            configurationContext.getSamlRegisteredServiceCachingMetadataResolver(),
            samlRegisteredService, logoutRequestIssuer);

        if (adapterResult.isEmpty()) {
            LOGGER.warn("Cannot find service provider metadata entity linked to [{}]", logoutRequestIssuer);
            return null;
        }
        
        val adaptor = adapterResult.get();
        val binding = determineLogoutResponseBindingType(adaptor, samlRegisteredService);
        LOGGER.debug("Logout response binding type is determined as [{}]", binding);

        if (SAMLConstants.SAML2_POST_BINDING_URI.equals(binding)) {
            return handleSingleLogoutForPostBinding(samlLogoutRequest, samlRegisteredService, adaptor, request, response);
        }
        return handleSingleLogoutForRedirectBinding(samlLogoutRequest, samlRegisteredService, adaptor, request, response);
    }

    protected String determineLogoutResponseBindingType(final SamlRegisteredServiceMetadataAdaptor adaptor,
                                                        final SamlRegisteredService samlRegisteredService) {

        val logout = configurationContext.getCasProperties().getAuthn().getSamlIdp().getLogout();
        var binding = logout.getLogoutResponseBinding();

View on GitHub (pinned to e7288fc434)