Skipping metadata [ ]; Either the resource cannot be…

Error message

Skipping metadata [{}]; Either the resource cannot be retrieved or its signing key is missing

What it means

Final gate in configureResource: a metadata reference is skipped when either it was disqualified earlier (e.g. missing signing key, error 628) or the resource cannot actually be retrieved. CAS warns and excludes it from the MDUI resolver aggregate.

Solutions

Check that the metadataReference path/URL is correct and the file exists in the runtime environment.
If the skip follows warning 628, fix the signing key first.
Confirm container volume mounts include the MDUI metadata directory.
Enable debug logging for SamlMetadataUIConfiguration to see which condition failed for the reference.

Example fix

// before
cas.saml-metadata-ui.metadata[0]=file:/etc/cas/mdui/federation-ui.xml
// after (file actually deployed)
cas.saml-metadata-ui.metadata[0]=file:/etc/cas/mdui/federation-ui-metadata.xml

Defensive patterns

Strategy: validation

Validate before calling

var mdRes = applicationContext.getResource(metadataReference);
boolean usable = ResourceUtils.isUrl(metadataReference)
    || (mdRes != null && mdRes.exists() && mdRes.contentLength() > 0);
if (!usable) {
    LOGGER.warn("Metadata reference unusable: {}", metadataReference);
}

Prevention

Mount MDUI metadata files into containers and verify paths at deploy time.
Resolve any earlier signing-key warnings before re-checking this one.
Log and alert on skipped metadata references during resolver build.

When it happens

Trigger: addResource==false from a prior failure, or the metadataReference is not a URL and ResourceUtils.doesResourceExist returns false (missing file, bad path, unreachable non-URL resource) so the metadata resource is not added to the chain.

Common situations: MDUI metadata file absent from deployment; wrong resource path in cas.saml-metadata-ui metadata references; previous signing-key failure cascading into this skip; mounted volume not present in container.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/465d87369bbe66d0. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-mdui/src/main/java/org/apereo/cas/config/SamlMetadataUIConfiguration.java:98

            }
            var addResource = true;
            if (StringUtils.isNotBlank(signingKey)) {
                val sigFilter = SamlUtils.buildSignatureValidationFilter(applicationContext, signingKey);
                if (sigFilter != null) {
                    sigFilter.setRequireSignedRoot(casProperties.getSamlMetadataUi().isRequireSignedRoot());
                    sigFilter.initialize();
                    filters.add(sigFilter);
                } else {
                    LOGGER.warn("Failed to locate the signing key [{}] for [{}]", signingKey, metadataReference);
                    addResource = false;
                }
            }
            chain.setFilters(filters);
            if (addResource && (ResourceUtils.isUrl(metadataReference) || ResourceUtils.doesResourceExist(metadataReference))) {
                val resource = applicationContext.getResource(metadataReference);
                resources.put(resource, chain);
            } else {
                LOGGER.warn("Skipping metadata [{}]; Either the resource cannot be retrieved or its signing key is missing", metadataReference);
            }
        }));
    }

    @ConditionalOnMissingBean(name = "chainingSamlMetadataUIMetadataResolverAdapter")
    @Bean
    @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
    public MetadataResolverAdapter chainingSamlMetadataUIMetadataResolverAdapter(
        final CasConfigurationProperties casProperties,
        final ConfigurableApplicationContext applicationContext,
        @Qualifier(OpenSamlConfigBean.DEFAULT_BEAN_NAME)
        final OpenSamlConfigBean openSamlConfigBean) {
        val staticAdapter = new StaticMetadataResolverAdapter();
        configureAdapter(staticAdapter, applicationContext, casProperties, openSamlConfigBean);
        staticAdapter.buildMetadataResolverAggregate();

        val dynaAdapter = new DynamicMetadataResolverAdapter();
        configureAdapter(dynaAdapter, applicationContext, casProperties, openSamlConfigBean);

View on GitHub (pinned to e7288fc434)