Shibboleth IdP url is not specified; External…

Error message

Shibboleth IdP url is not specified; External authentication requests by the IdP will not be recognized

What it means

CasShibbolethIdPAutoConfiguration registers the Shibboleth IdP entity-id service selection strategy only when cas.authn.shib-idp.server-url is set. When that property is blank, the configuration logs this warning and skips registration, meaning inbound authentication requests proxied from the external Shibboleth IdP will not be recognized and matched to services.

Solutions

Set cas.authn.shib-idp.server-url to the base URL of the Shibboleth IdP (e.g. https://idp.example.org/idp)
Confirm the property is in the active Spring profile's configuration file
Restart the CAS server after adding the property so the auto-configuration re-registers the strategy
Verify with startup logs that the warning no longer appears and the selection strategy is registered

Example fix

// before (application.properties)
# cas.authn.shib-idp.server-url not set
// after
cas.authn.shib-idp.server-url=https://idp.example.org/idp

Defensive patterns

Strategy: validation

Validate before calling

// Fail fast at deployment if the property is absent
String url = env.getProperty("cas.authn.shib-idp.server-url");
if (url == null || url.isBlank())
    throw new IllegalStateException("cas.authn.shib-idp.server-url must be set when Shibboleth support is enabled");

Prevention

Include cas.authn.shib-idp.server-url in every profile that enables Shibboleth support
Grep startup logs for this warning in smoke tests
Keep shib-idp settings in one shared config include to avoid profile drift

When it happens

Trigger: Deploying the CAS Shibboleth support module without setting cas.authn.shib-idp.server-url in the configuration, then attempting external IdP-driven authentication flows.

Common situations: Forgetting the shib-idp block in application.properties/yml when integrating CAS with an external Shibboleth IdP; property present in a different profile (dev vs prod) not active at runtime; property name typo so the value stays null.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/1951fe20936a6e5d. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-shibboleth/src/main/java/org/apereo/cas/config/CasShibbolethIdPAutoConfiguration.java:64

        final ServiceFactory<WebApplicationService> webApplicationServiceFactory) {
        return new ShibbolethIdPEntityIdAuthenticationServiceSelectionStrategy(
            servicesManager,
            webApplicationServiceFactory,
            casProperties.getAuthn().getShibIdp().getServerUrl(),
            registeredServiceAccessStrategyEnforcer);
    }

    @Bean
    @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
    public AuthenticationServiceSelectionStrategyConfigurer shibbolethIdPAuthenticationServiceSelectionStrategyConfigurer(
        @Qualifier("shibbolethIdPEntityIdAuthenticationServiceSelectionStrategy")
        final AuthenticationServiceSelectionStrategy shibbolethIdPEntityIdAuthenticationServiceSelectionStrategy,
        final CasConfigurationProperties casProperties) {
        return plan -> {
            if (StringUtils.isNotBlank(casProperties.getAuthn().getShibIdp().getServerUrl())) {
                plan.registerStrategy(shibbolethIdPEntityIdAuthenticationServiceSelectionStrategy);
            } else {
                LOGGER.warn("Shibboleth IdP url is not specified; External authentication requests by the IdP will not be recognized");
            }
        };
    }

}

View on GitHub (pinned to e7288fc434)