No NameID could be determined based on the supported formats

Error message

No NameID could be determined based on the supported formats [{}]

What it means

determineNameId iterated the service's supported NameID formats and, for each, encodeNameIdBasedOnNameFormat returned null, so no NameID could be produced for the subject. The builder logs a warning and returns null, causing the SSO response building to lack a subject NameID for that service.

Solutions

Check CAS logs above this warning for the per-format failure cause from encodeNameIdBasedOnNameFormat
Ensure the attributes required for each configured NameID format are resolvable and released by the service attribute release policy
Configure a supported, achievable default NameID format (e.g. transient or persistent) for the service
Verify the format URIs in the service config are valid SAML NameID format URIs

Example fix

// before (service config)
"supportedNameIdFormats": ["urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress"]
// after (either release email attribute or use a format needing no custom attribute)
"supportedNameIdFormats": ["urn:oasis:names:tc:SAML:2.0:nameid-format:transient"]

Defensive patterns

Strategy: validation

Validate before calling

// Ensure the principal has attributes needed by the configured formats before SSO
val attrs = principal.getAttributes();
val fmts = service.getSupportedNameIdFormats();
if (fmts.contains(EMAIL_FORMAT) && !attrs.containsKey("email")) {
    LOGGER.warn("email attribute missing for emailAddress NameID format");
}

Try / catch

try {
    val nameId = nameID(context);
    if (nameId == null) {
        // no NameID could be encoded: abort or use fallback format
        throw new SamlException("No NameID produced for service " + context.getAdaptor().getEntityId());
    }
} catch (Exception e) {
    LOGGER.error("NameID generation failed", e);
}

Prevention

Release the attributes each configured NameID format requires via the attribute release policy
Prefer formats guaranteed by the IdP (e.g. transient) as defaults
Validate format URIs in service config against supported values
Enable DEBUG logging on SamlProfileSamlNameIdBuilder when onboarding SPs

When it happens

Trigger: nameID -> determineNameId with supportedNameFormats where every call to encodeNameIdBasedOnNameFormat(context, nameFormat) fails/returns null (e.g. attribute needed for the format is missing, format unrecognized, encoder throws and returns null).

Common situations: Service configured with NameID formats whose source attributes are absent from the principal (e.g. persistent format without a persistent id, emailAddress format without email attribute); attribute release policy filtering out required attributes; typo/unsupported format string in service config.

Understand the failure class

Background: EmptyResultError / "no results found": when an API or scraper succeeds but returns zero rows — this error's family across 9 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/b4ee3edb34f63ce8. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java:168

            LOGGER.warn("Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. "
                        + "The requested NameID format may not be honored. You should consult the metadata for this service "
                        + "and ensure the requested NameID format is present in the collection of supported "
                        + "metadata formats in the metadata, which are the following: [{}]",
                requiredNameFormat, SamlIdPUtils.getIssuerFromSamlObject(context.getSamlRequest()),
                context.getAdaptor().getEntityId(), context.getAdaptor().getSupportedNameIdFormats());
        }
    }

    protected NameID determineNameId(final List<String> supportedNameFormats, final SamlProfileBuilderContext context) {
        for (val nameFormat : supportedNameFormats) {
            LOGGER.debug("Evaluating NameID format [{}]", nameFormat);
            val nameId = encodeNameIdBasedOnNameFormat(context, nameFormat);
            if (nameId != null) {
                LOGGER.debug("Determined NameID based on format [{}] to be [{}]", nameFormat, nameId.getValue());
                return nameId;
            }
        }
        LOGGER.warn("No NameID could be determined based on the supported formats [{}]", supportedNameFormats);
        return null;
    }

    protected NameID encodeNameIdBasedOnNameFormat(final SamlProfileBuilderContext context,
                                                   final String nameFormat) {
        try {
            val attribute = prepareNameIdAttribute(context, nameFormat);
            val encoder = SamlAttributeBasedNameIdGenerator.get(Optional.of(context.getSamlRequest()),
                nameFormat, context.getRegisteredService(), attribute);
            context.getHttpRequest().setAttribute(NameID.class.getName(), attribute);
            LOGGER.debug("Encoding NameID based on [{}]", nameFormat);
            val prc = new ProfileRequestContext();
            val nameId = Objects.requireNonNull(encoder.generate(prc, nameFormat));
            LOGGER.debug("Final NameID encoded with format [{}] has value [{}]", nameId.getFormat(), nameId.getValue());
            return nameId;
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
        }

View on GitHub (pinned to e7288fc434)