No providerId parameter given in unsolicited SSO…

Error message

No providerId parameter given in unsolicited SSO authentication request.

What it means

The IdP-initiated (unsolicited) SSO endpoint was invoked without the required providerId request parameter, which identifies the SP entityID to authenticate against. extractProviderId treats a blank providerId as a malformed request and throws MessageDecodingException. Without it CAS cannot select a service or metadata.

Solutions

Append the providerId parameter with the SP's entityID to the unsolicited SSO URL (e.g. ?providerId=https%3A%2F%2Fsp.example.com%2Fshib).
URL-encode the entityID; special characters (://, spaces) in unencoded URLs can cause the parameter to be dropped by proxies.
Check any intermediary (proxy, WAF, gateway) is not stripping the query string; compare the request seen by CAS via access logs.
Confirm you are using the documented parameter name for your CAS version (SamlIdPConstants.PROVIDER_ID = 'providerId').

Example fix

// before: missing providerId
GET /cas/idp/profile/SAML2/Unsolicited/SSO?shire=https://sp.example.com/Shibboleth.sso/SAML2/POST
// after: include providerId (URL-encoded entityID)
GET /cas/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fsp.example.com%2Fshib&shire=https://sp.example.com/Shibboleth.sso/SAML2/POST

Defensive patterns

Strategy: validation

Validate before calling

// Caller-side guard before invoking the unsolicited SSO endpoint
String providerId = request.getParameter("providerId");
if (providerId == null || providerId.isBlank()) {
    throw new IllegalArgumentException("providerId is required for unsolicited SSO");
}

Type guard

boolean hasProviderId(HttpServletRequest req) { return StringUtils.isNotBlank(req.getParameter(SamlIdPConstants.PROVIDER_ID)); }

Try / catch

try {
    providerId = extractProviderId(request);
} catch (MessageDecodingException e) {
    LOGGER.error("Unsolicited SSO called without providerId from {}", request.getRemoteAddr(), e);
    // 400 with usage hint: append ?providerId=<url-encoded entityID>
}

Prevention

Generate unsolicited SSO links via a template that always includes providerId.
URL-encode the entityID when building links.
Verify proxies preserve query strings for the IdP endpoints.

When it happens

Trigger: A GET/POST to the unsolicited SSO profile endpoint (e.g. /idp/profile/SAML2/Unsolicited/SSO) missing the providerId query/form parameter, or the parameter present but empty/whitespace.

Common situations: Bookmark/portal link constructed incorrectly; reverse proxy or gateway stripping query parameters; SP integration guide followed with wrong parameter name (e.g. 'providerId' misspelled or case-incorrect); deep link regenerated by front-end code dropping params.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/8ae6d35b1d61d8c3. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java:171

            LOGGER.info("Resolving service provider assertion consumer service URL for [{}] and binding [{}]",
                providerId, SAMLConstants.SAML2_POST_BINDING_URI);
            val acs = facade.getAssertionConsumerService(SAMLConstants.SAML2_POST_BINDING_URI);
            shire = Optional.ofNullable(acs)
                .map(service -> StringUtils.isBlank(service.getResponseLocation())
                    ? service.getLocation()
                    : service.getResponseLocation()).orElse(null);
        }
        if (StringUtils.isBlank(shire)) {
            LOGGER.warn("Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: [{}]", providerId);
            throw new MessageDecodingException("Unable to resolve SP ACS URL for AuthnRequest construction");
        }
        return shire;
    }

    protected String extractProviderId(final HttpServletRequest request) throws MessageDecodingException {
        val providerId = request.getParameter(SamlIdPConstants.PROVIDER_ID);
        if (StringUtils.isBlank(providerId)) {
            LOGGER.warn("No providerId parameter given in unsolicited SSO authentication request.");
            throw new MessageDecodingException("Missing providerId");
        }
        return providerId;
    }
}

View on GitHub (pinned to e7288fc434)