Unable to accept request; issuer for endpoint(s)

Error message

Unable to accept request; issuer for endpoint(s) [{}] is invalid

What it means

The OIDC discovery (/.well-known/openid-configuration) controller serves the discovery document only when the request issuer matches the configured OIDC issuer for the requested endpoints. If isIssuerValidForEndpoint fails, CAS logs this warning and returns HTTP 404 NOT_FOUND instead of the discovery JSON.

Solutions

Point the RP's discovery URL at the exact issuer base (issuer + '/.well-known/openid-configuration')
Align cas.authn.oidc.issuer with the externally visible URL (scheme/host/port/path)
Fix proxy/load-balancer Host and X-Forwarded-* header forwarding
Check CAS logs for the determineIssuer value to see what issuer CAS actually derived

Example fix

// before
curl https://internal-host:8443/cas/oidc/.well-known/openid-configuration   # issuer is https://sso.example.org/cas/oidc
// after
curl https://sso.example.org/cas/oidc/.well-known/openid-configuration

Defensive patterns

Strategy: validation

Validate before calling

const wellKnown = new URL(casAuthnOidcIssuer + '/.well-known/openid-configuration');
if (new URL(discoveryUrl).origin !== wellKnown.origin) {
  throw new Error(`Discovery URL origin must match issuer origin ${wellKnown.origin}`);
}

Try / catch

const res = await fetch(discoveryUrl);
if (res.status === 404) {
  // issuer mismatch: rebuild discoveryUrl from the configured cas.authn.oidc.issuer
}

Prevention

Derive the discovery URL programmatically from the issuer string
Keep issuer and external hostname in sync
Preserve proxy headers
Verify with curl through the exact URL the RP uses

When it happens

Trigger: GET to the well-known discovery endpoint(s) where the request URL's issuer component does not validate against cas.authn.oidc.issuer for the listed endpoints.

Common situations: RP configured with the wrong discovery URL (hostname/protocol mismatch with issuer); proxy stripping the original host; clients querying an alternate well-known path; cas.authn.oidc.issuer containing an unsupported path/pattern.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/0a8665b636000b1a. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/discovery/OidcWellKnownEndpointController.java:103

        produces = "application/jrd+json")
    @Operation(summary = "Handle webfinger discovery request")
    public ResponseEntity<Map> getWebFingerResponse(
        @RequestParam("resource") final String resource,
        @RequestParam(value = "rel", required = false) final String rel) throws Throwable {
        return BeanSupplier.isNotProxy(webFingerDiscoveryService)
            ? webFingerDiscoveryService.handleRequest(resource, rel)
            : ResponseEntity.notFound().build();
    }

    private ResponseEntity<OidcServerDiscoverySettings> getOidcServerDiscoveryResponse(
        final HttpServletRequest request,
        final HttpServletResponse response,
        final List<String> endpoints) {
        if (isIssuerValidForEndpoint(request, response, endpoints)) {
            val discovery = configurationContext.getDiscoverySettings();
            return new ResponseEntity<>(discovery, HttpStatus.OK);
        }
        LOGGER.warn("Unable to accept request; issuer for endpoint(s) [{}] is invalid", endpoints);
        return new ResponseEntity<>(HttpStatus.NOT_FOUND);
    }
}

View on GitHub (pinned to e7288fc434)