apereo/cas · error · IllegalArgumentException

Missing parameter wresult

Error message

Missing parameter wresult

What it means

WsFederationResponseValidator.validateWsFederationAuthenticationRequest processes the WS-Fed sign-in response, which must contain the `wresult` parameter carrying the security token returned by the identity provider. If wresult is blank, it throws IllegalArgumentException because no token exists to parse or validate.

Solutions

1. Check that the upstream identity provider actually POSTs `wresult` to the configured CAS callback/claim endpoint.
2. Inspect the inbound HTTP request (access log or a debug filter) at the moment of failure to confirm whether wresult is absent at the network level or lost inside the webflow.
3. Ensure any reverse proxy forwards the full form body (Content-Type application/x-www-form-urlencoded) and does not rewrite the callback to a GET.
4. Guard the flow against page reloads on the validation endpoint (POST-redirect pattern or anti-replay handling) so stale reloads don't resurface this error.

Example fix

// before: relying on a redirect that drops the POST body
http.authorizeHttpRequests(a -> a.requestMatchers("/wsfed/callback").permitAll()); // proxy converts POST to GET
// after: preserve the POST form data end-to-end and verify wresult presence client-side
String wresult = request.getParameter("wresult");
if (wresult == null || wresult.isBlank()) {
    throw new IllegalStateException("Identity provider did not POST wresult to the callback");
}

String wresult = request.getParameter("wresult");
if (wresult == null || wresult.isBlank()) {
    throw new IllegalStateException("Callback must be reached via IdP POST carrying wresult");
}

When it happens

Trigger: The webflow reaches the response-validation action and request.getParameter(WRESULT) returns null/empty — the IdP response POST lacked wresult, or the value was lost in transit (proxy, encoding, session handling).

Common situations: Misconfigured WS-Fed client sending wresult only on a different endpoint or dropping it on redirect; intermediaries stripping POST bodies; users bookmarking/reloading the callback URL so the POST body is gone; RP session resumption replaying a GET that never carried wresult.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Unable to determine the [WA] parameter
• The authentication request is not recognized
• Failed to load configuration metadata
• Unable to accept response status
• <policy status exception>

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/202a45dc7af69dd8. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-wsfederation-webflow/src/main/java/org/apereo/cas/web/flow/WsFederationResponseValidator.java:58

    private final WsFederationCookieManager wsFederationCookieManager;

    /**
     * Validate ws federation authentication request event.
     *
     * @param context the context
     * @throws Throwable the throwable
     */
    public void validateWsFederationAuthenticationRequest(final RequestContext context) throws Throwable {
        val service = wsFederationCookieManager.retrieve(context);
        LOGGER.debug("Retrieved service [{}] from the session cookie", service);

        val request = WebUtils.getHttpServletRequestFromExternalWebflowContext(context);
        val wResult = request.getParameter(WRESULT);
        LOGGER.debug("Parameter [{}] received: [{}]", WRESULT, wResult);
        if (StringUtils.isBlank(wResult)) {
            LOGGER.error("No [{}] parameter is found", WRESULT);
            throw new IllegalArgumentException("Missing parameter " + WRESULT);
        }
        LOGGER.debug("Attempting to create an assertion from the token parameter");
        val rsToken = wsFederationHelper.getRequestSecurityTokenFromResult(wResult);
        val assertion = wsFederationHelper.buildAndVerifyAssertion(rsToken, configurations, service);
        if (assertion == null) {
            LOGGER.error("Could not validate assertion via parsing the token from [{}]", WRESULT);
            throw new IllegalArgumentException("Could not validate assertion via the provided token");
        }
        LOGGER.debug("Attempting to validate the signature on the assertion");
        if (!wsFederationHelper.validateSignature(assertion)) {
            val msg = "WS Requested Security Token is blank or the signature is not valid.";
            LOGGER.error(msg);
            throw new IllegalArgumentException(msg);
        }
        buildCredentialsFromAssertion(context, assertion, service);
    }

    private void buildCredentialsFromAssertion(final RequestContext context,

View on GitHub (pinned to e7288fc434)