{"record":{"id":"05965c228910608a","repo":"apereo/cas","slug":"failed-to-locate-the-signing-key-for","errorCode":null,"errorMessage":"Failed to locate the signing key [{}] for [{}]","messagePattern":"Failed to locate the signing key \\[(.+?)\\] for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-mdui/src/main/java/org/apereo/cas/config/SamlMetadataUIConfiguration.java","lineNumber":89,"sourceCode":"            val arr = Splitter.on(DEFAULT_SEPARATOR).splitToList(entry);\n            val metadataReference = arr.getFirst();\n            val signingKey = arr.size() > 1 ? arr.get(1) : null;\n            val filters = new ArrayList<MetadataFilter>();\n            if (casProperties.getSamlMetadataUi().getMaxValidity() > 0) {\n                val filter = new RequiredValidUntilFilter();\n                filter.setMaxValidityInterval(Duration.ofSeconds(casProperties.getSamlMetadataUi().getMaxValidity()));\n                filter.initialize();\n                filters.add(filter);\n            }\n            var addResource = true;\n            if (StringUtils.isNotBlank(signingKey)) {\n                val sigFilter = SamlUtils.buildSignatureValidationFilter(applicationContext, signingKey);\n                if (sigFilter != null) {\n                    sigFilter.setRequireSignedRoot(casProperties.getSamlMetadataUi().isRequireSignedRoot());\n                    sigFilter.initialize();\n                    filters.add(sigFilter);\n                } else {\n                    LOGGER.warn(\"Failed to locate the signing key [{}] for [{}]\", signingKey, metadataReference);\n                    addResource = false;\n                }\n            }\n            chain.setFilters(filters);\n            if (addResource && (ResourceUtils.isUrl(metadataReference) || ResourceUtils.doesResourceExist(metadataReference))) {\n                val resource = applicationContext.getResource(metadataReference);\n                resources.put(resource, chain);\n            } else {\n                LOGGER.warn(\"Skipping metadata [{}]; Either the resource cannot be retrieved or its signing key is missing\", metadataReference);\n            }\n        }));\n    }\n\n    @ConditionalOnMissingBean(name = \"chainingSamlMetadataUIMetadataResolverAdapter\")\n    @Bean\n    @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n    public MetadataResolverAdapter chainingSamlMetadataUIMetadataResolverAdapter(\n        final CasConfigurationProperties casProperties,","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-mdui/src/main/java/org/apereo/cas/config/SamlMetadataUIConfiguration.java#L71-L107","documentation":"When configuring the MDUI metadata resolver chain, CAS builds a signature validation filter from the configured signing key. If SamlUtils.buildSignatureValidationFilter returns null for the given key/reference, this warning is logged and the metadata resource is excluded (addResource = false).","triggerScenarios":"configureResource has a signing key configured for the metadataReference, but the key cannot be loaded/located — bad path, unreadable keystore/cert file, unsupported key format — so buildSignatureValidationFilter yields null.","commonSituations":"Typo in signing key path in cas.saml-metadata-ui config; certificate file missing in container image; key in unsupported format (e.g. DER vs PEM); wrong keystore password handled upstream producing null instead of throw.","solutions":["Verify the signing key resource path exists and is readable by CAS (ResourceUtils.doesResourceExist).","Check the key format is one OpenSAML's SignatureValidationFilter supports (X.509 PEM cert or keystore).","Rebuild the signing key path or embed the certificate in metadata trust.","If signature validation is not needed, remove the signing key config so the filter branch is skipped."],"exampleFix":"// before\ncas.saml-metadata-ui.signing-key[0]=file:/etc/cas/mdui/missing-cert.pem\n// after\ncas.saml-metadata-ui.signing-key[0]=file:/etc/cas/mdui/federation-signer.pem","handlingStrategy":"validation","validationCode":"var keyRes = applicationContext.getResource(signingKey);\nif (!keyRes.exists()) {\n    LOGGER.warn(\"Signing key missing: {}\", signingKey);\n    // fix path or disable signature validation\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify signing key paths exist in the deployed image before startup.","Use standard PEM/keystore formats supported by OpenSAML.","Add a startup health check that loads configured signing keys."],"tags":["metadata","signing","configuration"],"backgroundTag":"missing-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}