apereo/cas · warning

No principal could be identified in the claim parameters…

Error message

No principal could be identified in the claim parameters request

What it means

retrieveClaimValues requires an authenticated principal in ClaimsParameters. When parameters.getPrincipal() is null it logs this warning and returns an empty claim collection, because attribute/claim resolution is identity-driven and cannot proceed without a subject.

Solutions

1. Ensure the token provider/validator populates ClaimsParameters.setPrincipal(Principal) with the authenticated user before claims retrieval.
2. Check upstream validation steps: if the credential failed validation the principal never gets attached; fix the root authentication failure.
3. For service-actor scenarios, supply a synthetic principal if your flow legitimately has no user identity.

Example fix

// before
val params = new ClaimsParameters<>();
params.setRealm(realm);
// after
val params = new ClaimsParameters<>();
params.setRealm(realm);
params.setPrincipal(userPrincipal); // authenticated subject

if (parameters.getPrincipal() == null) {
    throw new IllegalStateException("ClaimsParameters has no principal; authentication must complete first");
}

boolean hasPrincipal(ClaimsParameters<?> p) {
    return p.getPrincipal() != null && StringUtils.isNotBlank(p.getPrincipal().getName());
}

When it happens

Trigger: ClaimsParameters built without setPrincipal(...) before retrieveClaimValues is invoked — typically when the STS token provider failed to resolve an authenticated user for the request (anonymous validation, missing credential, or custom token provider that skips principal setup).

Common situations: Custom SecurityTokenServiceProvider/TokenProvider that constructs ClaimsParameters manually and forgets the principal; anonymous or bearer-token flows that do not authenticate the caller; earlier validation failure swallowed upstream.

Related errors

• Realm [ ] doesn't match with configured realm [ ]
• No claims are available to process
• Authentication handler is disabled
• No user can be accepted because none is defined
• not found in backing map.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/83772299ae244a68. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java:47

    private final String handlerRealm;

    private final String issuer;

    @Override
    public List<String> getSupportedClaimTypes() {
        return WSFederationClaims.ALL_CLAIMS.stream()
            .map(WSFederationClaims::getUri)
            .collect(Collectors.toList());
    }

    @Override
    public ProcessedClaimCollection retrieveClaimValues(final ClaimCollection claims, final ClaimsParameters parameters) {
        if (parameters.getRealm() == null || !parameters.getRealm().equalsIgnoreCase(this.handlerRealm)) {
            LOGGER.warn("Realm [{}] doesn't match with configured realm [{}]", parameters.getRealm(), this.handlerRealm);
            return new ProcessedClaimCollection();
        }
        if (parameters.getPrincipal() == null) {
            LOGGER.warn("No principal could be identified in the claim parameters request");
            return new ProcessedClaimCollection();
        }
        if (claims == null || claims.isEmpty()) {
            LOGGER.warn("No claims are available to process");
            return new ProcessedClaimCollection();
        }
        val claimCollection = new ProcessedClaimCollection();
        claims.stream().map(c -> createProcessedClaim(c, parameters)).forEach(claimCollection::add);
        return claimCollection;
    }

    /**
     * Create processed claim processed claim.
     *
     * @param requestClaim the request claim
     * @param parameters   the parameters
     * @return the processed claim
     */

View on GitHub (pinned to e7288fc434)