apereo/cas · error · SamlException

No assertion consumer service could be found for entity

Error message

No assertion consumer service could be found for entity 

What it means

SamlIdPUtils.preparePeerEntitySamlEndpointContext() builds the outbound OpenSAML message context for a peer SP. Before wiring the peer entity and endpoint contexts it checks adaptor.containsAssertionConsumerServices(); if the SP's SAML metadata exposes no AssertionConsumerService entries, it throws a SamlException because there is nowhere to send the response.

Solutions

1. Inspect the SP metadata at the configured metadataLocation and add at least one <md:AssertionConsumerService> with Binding and Location to the SPSSODescriptor.
2. Confirm the entityID used to resolve metadata matches the SP that actually declares ACS entries.
3. Re-fetch/re-import the SP metadata from the vendor if it was truncated or hand-edited.
4. Guard the call site: check adaptor.containsAssertionConsumerServices() before invoking and fail with a clearer service-level error.

Example fix

// before
SamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding); // throws

// after
if (!adaptor.containsAssertionConsumerServices()) {
    throw new SamlException("SP metadata for " + adaptor.getEntityId() + " has no ACS; fix metadata before proceeding");
}
SamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding);

// before building the outbound context
if (!adaptor.containsAssertionConsumerServices()) {
    throw new SamlException("SP metadata for " + adaptor.getEntityId() + " declares no ACS");
}

try {
    SamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding);
} catch (SamlException e) {
    logger.error("Cannot resolve SP endpoint: {} — check SP metadata ACS entries", e.getMessage());
}

When it happens

Trigger: Calling preparePeerEntitySamlEndpointContext() with a SamlRegisteredServiceMetadataAdaptor whose resolved metadata for entityId contains an SPSSODescriptor with zero AssertionConsumerService elements (or no SPSSODescriptor ACS at all).

Common situations: SP metadata uploaded/published contains only an IDPSSODescriptor, metadata was hand-edited and ACS elements stripped, or the metadata document is for the wrong entityID so the adaptor resolves an SP entry without ACS.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• Unable to locate acs url in for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…
• Assertion consumer service
• Metadata directory location cannot be located/created

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/eb23ff553270e579. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java:85

    }


    /**
     * Prepare peer entity saml endpoint.
     *
     * @param authnContext    the authn context
     * @param outboundContext the outbound context
     * @param adaptor         the adaptor
     * @param binding         the binding
     * @throws SamlException the saml exception
     */
    public static void preparePeerEntitySamlEndpointContext(final Pair<? extends RequestAbstractType, MessageContext> authnContext,
                                                            final MessageContext outboundContext,
                                                            final SamlRegisteredServiceMetadataAdaptor adaptor,
                                                            final String binding) throws SamlException {
        val entityId = adaptor.getEntityId();
        if (!adaptor.containsAssertionConsumerServices()) {
            throw new SamlException("No assertion consumer service could be found for entity " + entityId);
        }

        val peerEntityContext = outboundContext.ensureSubcontext(SAMLPeerEntityContext.class);
        peerEntityContext.setEntityId(entityId);

        val endpointContext = peerEntityContext.ensureSubcontext(SAMLEndpointContext.class);
        val endpoint = determineEndpointForRequest(authnContext, adaptor, binding);
        LOGGER.debug("Configured peer entity endpoint to be [{}] with binding [{}]", endpoint.getLocation(), endpoint.getBinding());
        endpointContext.setEndpoint(endpoint);
    }

    /**
     * Determine assertion consumer service assertion consumer service.
     *
     * @param authnContext the authn context
     * @param adaptor      the adaptor
     * @param binding      the binding
     * @return the assertion consumer service

View on GitHub (pinned to e7288fc434)