Retrieved realm from CN of SAML assertion certificate

Error message

Retrieved realm from CN of SAML assertion certificate [{}] does not match the CAS realm [{}]. Beware that realm mismatch does requires configuration to implement realm relationships or identity mapping

What it means

SamlAssertionRealmCodec.getRealmFromToken derives the realm from the CN of the certificate used to sign the SAML assertion. When that CN does not equal (case-insensitively) the configured CAS realm it logs this warning and still returns the parsed CN. The warning flags that cross-realm trust/identity mapping may be missing.

Solutions

Reissue or select a signing certificate whose CN matches the configured CAS realm.
Update the CAS realm configuration to match the CN used by the partner certificate.
If cross-realm use is intentional, configure realm relationships/identity mapping so downstream logic handles the mismatch.
Treat the returned parsed value (not the configured realm) as effective downstream; verify consumers accept it.

Example fix

// before
// cert CN=REALM_X, configured realm REALM_A -> warning
// after: configure realm relationships or align names
realm = "REALM_X"; // matches certificate CN

Defensive patterns

Strategy: validation

Validate before calling

String cn = parseCNValue(cert.getSubjectX500Principal().getName());
if (!cn.equalsIgnoreCase(configuredRealm)) {
    LOGGER.warn("Certificate CN realm {} differs from configured realm {}; ensure realm mapping exists", cn, configuredRealm);
}

Prevention

Issue partner certificates with CN equal to the realm name.
Document cross-realm relationships explicitly in configuration.
Alert on this warning in log monitoring since it often indicates trust misconfiguration.

When it happens

Trigger: A SAML assertion is signed with a certificate whose subject CN names a different realm than the CAS STS realm handling the request.

Common situations: Federation across realms where partner certificates carry their own realm CN; certificate rotated/reissued with a different CN; configuration updated to a new realm name but partner cert CN not updated; missing realm-relationship/identity-mapping configuration.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/af27cb27de1a0389. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/saml/SamlAssertionRealmCodec.java:34

 * @author Misagh Moayyed
 * @since 5.1.0
 */
@Slf4j
@RequiredArgsConstructor
public class SamlAssertionRealmCodec implements SAMLRealmCodec {

    private final String realm;

    @Override
    public String getRealmFromToken(final SamlAssertionWrapper assertion) {
        val ki = assertion.getSignatureKeyInfo();
        val certs = ki.getCerts();
        val parsed = parseCNValue(certs[0].getSubjectX500Principal().getName());
        LOGGER.debug("Realm parsed from certificate CN of the SAML assertion: [{}]", parsed);
        if (Strings.CI.equals(parsed, realm)) {
            return parsed;
        }
        LOGGER.warn("Retrieved realm from CN of SAML assertion certificate [{}] does not match the CAS realm [{}]. "
                + "Beware that realm mismatch does requires configuration to implement realm relationships or identity mapping",
            parsed, realm);
        return parsed;
    }

    private static String parseCNValue(final String name) {
        val matcher = RegexUtils.createPattern("cn=(\\w+)").matcher(name);
        if (matcher.find()) {
            val commonName = matcher.group(1);
            return commonName.toUpperCase(Locale.ENGLISH);
        }
        return null;
    }
}

View on GitHub (pinned to e7288fc434)