Required NameID format

Error message

Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. The requested NameID format may not be honored. You should consult the metadata for this service and ensure the requested NameID format is present in the collection of supported metadata formats in the metadata, which are the following: [{}]

What it means

The SP's AuthnRequest requested a specific NameID Format, but that format is not among the NameID formats the SAML IdP metadata adapter supports for this service. This is a warning: the IdP proceeds with a supported format and the requested format may not be honored, which can break SPs that strictly validate the returned NameID format.

Solutions

Add the requested NameID format to the registered service's supportedNameIdFormats
Adjust the SP's AuthnRequest to request a NameID format the IdP supports
Verify the SAML service metadata/adaptor exposes the formats you intend (getSupportedNameIdFormats)
If honoring the SP format is impossible, inform the SP owner to relax NameID format validation

Example fix

// before (service config)
"supportedNameIdFormats": ["urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"]
// after
"supportedNameIdFormats": ["urn:oasis:names:tc:SAML:2.0:nameid-format:persistent","urn:oasis:names:tc:SAML:2.0:nameid-format:transient"]

Defensive patterns

Strategy: validation

Validate before calling

// Before the request round-trip, compare requested vs supported formats
val requested = authnRequest.getNameIDPolicy() != null
    ? authnRequest.getNameIDPolicy().getFormat() : null;
if (requested != null && !service.getSupportedNameIdFormats().contains(requested)) {
    LOGGER.warn("SP [{}] requests unsupported format [{}]", service.getServiceId(), requested);
}

Try / catch

// Typically a warning, not an exception; if you re-throw on strict SPs:
try {
    nameIdBuilder.build(context);
} catch (SamlException e) {
    LOGGER.error("NameID format mismatch for SP", e);
    // fail the request rather than emitting an unaccepted NameID
}

Prevention

Keep the service's supportedNameIdFormats in sync with each SP's metadata NameIDFormat list
Test SP flows after changing NameID format configuration
Use transient/persistent formats widely supported across SPs
Review IdP logs for this warning during SP onboarding

When it happens

Trigger: validateRequiredNameIdFormatIfAny is invoked from buildNameId with a non-blank requiredNameFormat extracted from the AuthnRequest that is not present in the service's supportedNameIdFormats (context.getAdaptor().getSupportedNameIdFormats()).

Common situations: SP requests transient/persistent/encrypted formats the IdP service config does not list; service metadata missing <NameIDFormat> entries; mismatch after changing the registered service's supportedNameIdFormats; SP hard-codes an unusual format like emailAddress while IdP is configured for unspecified.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4247dcee5519d470. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java:150

                }
            }

            if (!Strings.CI.equals(registeredService.getServiceProviderNameIdQualifier(), "none")
                 && !registeredService.isSkipGeneratingServiceProviderNameIdQualifier()) {
                FunctionUtils.doIf(StringUtils.isNotBlank(registeredService.getServiceProviderNameIdQualifier()),
                        value -> nameid.setSPNameQualifier(registeredService.getServiceProviderNameIdQualifier()),
                        value -> nameid.setSPNameQualifier(context.getAdaptor().getEntityId()))
                    .accept(registeredService);
            }
        }
        return nameid;
    }

    protected void validateRequiredNameIdFormatIfAny(final List<String> supportedNameFormats,
                                                     final String requiredNameFormat,
                                                     final SamlProfileBuilderContext context) {
        if (StringUtils.isNotBlank(requiredNameFormat) && !supportedNameFormats.contains(requiredNameFormat)) {
            LOGGER.warn("Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. "
                        + "The requested NameID format may not be honored. You should consult the metadata for this service "
                        + "and ensure the requested NameID format is present in the collection of supported "
                        + "metadata formats in the metadata, which are the following: [{}]",
                requiredNameFormat, SamlIdPUtils.getIssuerFromSamlObject(context.getSamlRequest()),
                context.getAdaptor().getEntityId(), context.getAdaptor().getSupportedNameIdFormats());
        }
    }

    protected NameID determineNameId(final List<String> supportedNameFormats, final SamlProfileBuilderContext context) {
        for (val nameFormat : supportedNameFormats) {
            LOGGER.debug("Evaluating NameID format [{}]", nameFormat);
            val nameId = encodeNameIdBasedOnNameFormat(context, nameFormat);
            if (nameId != null) {
                LOGGER.debug("Determined NameID based on format [{}] to be [{}]", nameFormat, nameId.getValue());
                return nameId;
            }
        }
        LOGGER.warn("No NameID could be determined based on the supported formats [{}]", supportedNameFormats);

View on GitHub (pinned to e7288fc434)