apereo/cas · warning

Could not locate metadata for

Error message

Could not locate metadata for [{}] to process attributes

What it means

BaseSamlRegisteredServiceAttributeReleasePolicy.getAttributesInternal() resolves the SP metadata facade for the entity id extracted from the request before computing released attributes. When the entity id is blank or no metadata adaptor can be found for it, it logs this warning and returns an empty attribute map, releasing no attributes rather than failing the flow.

Solutions

1. Confirm the SP entityID exists in the metadata loaded by the IdP metadata resolver and refresh metadata if stale
2. Check that the policy is only applied within an actual SAML request context that carries the entity id
3. Log/inspect SamlIdPSAttributeReleasePolicyUtils.getEntityIdFromRequest(context) to see what id is being resolved
4. Fix the service definition's entityId to exactly match the metadata EntityDescriptor entityID

Example fix

// before: empty release with no diagnosis
return new HashMap<>();
// after: guard/fail fast when metadata is missing
if (facade.isEmpty()) {
    throw new SamlException("No metadata for entity " + entityId);
}

// verify entity metadata before evaluating the policy
val facade = SamlIdPSAttributeReleasePolicyUtils
    .determineServiceProviderMetadataFacade(context, entityId);
if (facade.isEmpty()) throw new IllegalStateException('No metadata for ' + entityId);

function metadataExists(ctx, entityId) { return entityId != null && !entityId.isBlank() && findMetadata(ctx, entityId).isPresent(); }

val attrs = policy.getAttributes(...);
if (attrs.isEmpty()) { /* audit logs: was metadata missing for the entity? */ }

When it happens

Trigger: Attribute release is evaluated for a SAML response whose requester entity id is absent from the request context, or determineServiceProviderMetadataFacade cannot find metadata for that entity id in the configured metadata resolvers.

Common situations: SP's entityID not present in the loaded IdP metadata (metadata not yet loaded/refreshed); attribute release policy applied outside a SAML request context so no entity id is extractable; mismatched entityID casing/spelling between SP and metadata; metadata resolver scoped to a different entity set.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

• Cannot find entity [ ] in metadata provider for criteria [ ]
• No assertion consumer service could be found for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…
• Metadata directory location cannot be located/created

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/472c62496e362e57. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/BaseSamlRegisteredServiceAttributeReleasePolicy.java:37

@Slf4j
public abstract class BaseSamlRegisteredServiceAttributeReleasePolicy extends ReturnAllowedAttributeReleasePolicy {
    @Serial
    private static final long serialVersionUID = -3301632236702329694L;
    
    @Override
    public Map<String, List<Object>> getAttributesInternal(final RegisteredServiceAttributeReleasePolicyContext context,
                                                           final Map<String, List<Object>> attributes) {
        if (context.getRegisteredService() instanceof SamlRegisteredService) {
            val applicationContext = context.getApplicationContext();
            val resolver = applicationContext.getBean(SamlRegisteredServiceCachingMetadataResolver.BEAN_NAME,
                SamlRegisteredServiceCachingMetadataResolver.class);
            val entityId = SamlIdPSAttributeReleasePolicyUtils.getEntityIdFromRequest(context);
            val facade = StringUtils.isBlank(entityId)
                ? Optional.<SamlRegisteredServiceMetadataAdaptor>empty()
                : SamlIdPSAttributeReleasePolicyUtils.determineServiceProviderMetadataFacade(context, entityId);

            if (facade.isEmpty()) {
                LOGGER.warn("Could not locate metadata for [{}] to process attributes", entityId);
                return new HashMap<>();
            }

            val entityDescriptor = facade.get().getEntityDescriptor();
            return getAttributesForSamlRegisteredService(attributes, resolver, facade.get(), entityDescriptor, context);
        }
        return authorizeReleaseOfAllowedAttributes(context, attributes);
    }

    protected abstract Map<String, List<Object>> getAttributesForSamlRegisteredService(
        Map<String, List<Object>> attributes,
        SamlRegisteredServiceCachingMetadataResolver resolver,
        SamlRegisteredServiceMetadataAdaptor facade,
        EntityDescriptor entityDescriptor,
        RegisteredServiceAttributeReleasePolicyContext context);
}

View on GitHub (pinned to e7288fc434)