apereo/cas · warning

No claims are available to process

Error message

No claims are available to process

What it means

retrieveClaimValues returns an empty ProcessedClaimCollection with this warning when the requested ClaimCollection is null or has no claims. There is nothing to resolve, so the handler short-circuits rather than returning an empty-but-valid collection silently.

Solutions

1. Configure the client/claim request to include the claims the relying party needs (populate wst:Claims / ClaimsCollection).
2. Check any claim-filtering or required-claims configuration that might strip all claims before the handler runs.
3. If empty claims are legitimately allowed, ignore this warning — behavior (empty collection) is correct.

Example fix

// before
// RST with empty <wst:Claims/>
// after
< rightful claims >
<wst:Claims Dialect="...">
  <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"/>
</wst:Claims>

if (claims == null || claims.isEmpty()) {
    throw new IllegalArgumentException("No claims requested in the RST");
}

boolean hasRequestedClaims(ClaimCollection claims) {
    return claims != null && !claims.isEmpty();
}

When it happens

Trigger: The RST (RequestSecurityToken) carried an empty or missing ClaimsType section, or the caller passed null/empty claims into the handler.

Common situations: Client requests a token without specifying required claims while server-side required-claims filtering removes everything; misconfigured applied scope/claim mappings; client SDK sends empty wst:Claims element.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• Realm [ ] doesn't match with configured realm [ ]
• No principal could be identified in the claim parameters…
• Resolved credentials for this transaction are empty
• JWT time claim is invalid
• JWT audience is invalid

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/e2ba3b57747640ee. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java:51

    @Override
    public List<String> getSupportedClaimTypes() {
        return WSFederationClaims.ALL_CLAIMS.stream()
            .map(WSFederationClaims::getUri)
            .collect(Collectors.toList());
    }

    @Override
    public ProcessedClaimCollection retrieveClaimValues(final ClaimCollection claims, final ClaimsParameters parameters) {
        if (parameters.getRealm() == null || !parameters.getRealm().equalsIgnoreCase(this.handlerRealm)) {
            LOGGER.warn("Realm [{}] doesn't match with configured realm [{}]", parameters.getRealm(), this.handlerRealm);
            return new ProcessedClaimCollection();
        }
        if (parameters.getPrincipal() == null) {
            LOGGER.warn("No principal could be identified in the claim parameters request");
            return new ProcessedClaimCollection();
        }
        if (claims == null || claims.isEmpty()) {
            LOGGER.warn("No claims are available to process");
            return new ProcessedClaimCollection();
        }
        val claimCollection = new ProcessedClaimCollection();
        claims.stream().map(c -> createProcessedClaim(c, parameters)).forEach(claimCollection::add);
        return claimCollection;
    }

    /**
     * Create processed claim processed claim.
     *
     * @param requestClaim the request claim
     * @param parameters   the parameters
     * @return the processed claim
     */
    protected ProcessedClaim createProcessedClaim(final Claim requestClaim, final ClaimsParameters parameters) {
        val claim = new ProcessedClaim();
        claim.setClaimType(createProcessedClaimType(requestClaim, parameters));
        claim.setIssuer(this.issuer);

View on GitHub (pinned to e7288fc434)