apereo/cas · warning

Cannot find SLO service in metadata for entity id

Error message

Cannot find SLO service in metadata for entity id [{}]

What it means

The SP's EntityDescriptor was found in metadata, but it declares no SingleLogoutService endpoint for any of the bindings CAS supports for logout. CAS logs this warning and returns null, so no logout request is sent to that SP.

Solutions

1. Regenerate/repair SP metadata to include SingleLogoutService endpoints (HTTP-Redirect/POST).
2. Add the binding used by the SP to cas.authn.saml-idp.logout.single-logout bindings list.
3. Verify with the SP vendor whether SLO is supported at all; if not, accept null and skip back-channel logout.
4. Compare the bindings in metadata against CAS's logoutRequestBindings via debug logs.

Example fix

// before
cas.authn.saml-idp.logout.single-logout=["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"]
// after
cas.authn.saml-idp.logout.single-logout=["urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect","urn:oasis:names:tc:SAML:2.0:bindings:SOAP"]

var hasSlo = Arrays.stream(logoutRequestBindings)
    .anyMatch(b -> adaptor.getSingleLogoutService(b) != null);
if (!hasSlo) {
    LOGGER.info("SP {} has no SLO endpoint; skipping back-channel logout", entityID);
}

When it happens

Trigger: buildLogoutUrl iterates logoutRequestBindings and adaptor.getSingleLogoutService(binding) returns null for every binding — the SP metadata has no <md:SingleLogoutService> elements, or only bindings CAS isn't configured to use.

Common situations: SP metadata exports SSO but not SLO; metadata lists SingleLogoutService with a binding (e.g. SOAP) not in cas.authn.saml-idp.logout bindings; trimmed/minimal SP metadata.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Cannot find service provider metadata entity linked to
• Cannot find metadata linked to
• No assertion consumer service could be found for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/575de50f9f636ee9. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceLogoutUrlBuilder.java:112

                return attribute.getEntityIdFrom(samlRegisteredServiceCachingMetadataResolver, attributeValue);
            })
            .orElseGet(singleLogoutService::getId);
        LOGGER.trace("Located entity id [{}]", entityID);

        val adaptorRes = SamlRegisteredServiceMetadataAdaptor.get(
            samlRegisteredServiceCachingMetadataResolver, samlRegisteredService, entityID);
        if (adaptorRes.isEmpty()) {
            LOGGER.warn("Cannot find metadata linked to [{}]", entityID);
            return null;
        }
        val adaptor = adaptorRes.get();
        for (val binding : this.logoutRequestBindings) {
            var sloService = adaptor.getSingleLogoutService(binding);
            if (sloService != null) {
                return finalizeSingleLogoutUrl(sloService, samlRegisteredService);
            }
        }
        LOGGER.warn("Cannot find SLO service in metadata for entity id [{}]", entityID);
        return null;
    }

    private static @Nullable SingleLogoutUrl finalizeSingleLogoutUrl(final SingleLogoutService sloService, final SamlRegisteredService service) {
        val location = StringUtils.isBlank(sloService.getResponseLocation())
            ? sloService.getLocation()
            : sloService.getResponseLocation();
        if (StringUtils.isNotBlank(location)) {
            val url = new SingleLogoutUrl(location, service.getLogoutType());
            url.getProperties().put(PROPERTY_NAME_SINGLE_LOGOUT_BINDING, sloService.getBinding());
            return url;
        }
        return null;
    }
}

View on GitHub (pinned to e7288fc434)