{"record":{"id":"0a8665b636000b1a","repo":"apereo/cas","slug":"unable-to-accept-request-issuer-for-endpoint-s","errorCode":null,"errorMessage":"Unable to accept request; issuer for endpoint(s) [{}] is invalid","messagePattern":"Unable to accept request; issuer for endpoint\\(s\\) \\[(.+?)\\] is invalid","errorType":"console","errorClass":null,"httpStatus":404,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/discovery/OidcWellKnownEndpointController.java","lineNumber":103,"sourceCode":"        produces = \"application/jrd+json\")\n    @Operation(summary = \"Handle webfinger discovery request\")\n    public ResponseEntity<Map> getWebFingerResponse(\n        @RequestParam(\"resource\") final String resource,\n        @RequestParam(value = \"rel\", required = false) final String rel) throws Throwable {\n        return BeanSupplier.isNotProxy(webFingerDiscoveryService)\n            ? webFingerDiscoveryService.handleRequest(resource, rel)\n            : ResponseEntity.notFound().build();\n    }\n\n    private ResponseEntity<OidcServerDiscoverySettings> getOidcServerDiscoveryResponse(\n        final HttpServletRequest request,\n        final HttpServletResponse response,\n        final List<String> endpoints) {\n        if (isIssuerValidForEndpoint(request, response, endpoints)) {\n            val discovery = configurationContext.getDiscoverySettings();\n            return new ResponseEntity<>(discovery, HttpStatus.OK);\n        }\n        LOGGER.warn(\"Unable to accept request; issuer for endpoint(s) [{}] is invalid\", endpoints);\n        return new ResponseEntity<>(HttpStatus.NOT_FOUND);\n    }\n}\n","sourceCodeStart":85,"sourceCodeEnd":107,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/discovery/OidcWellKnownEndpointController.java#L85-L107","documentation":"The OIDC discovery (/.well-known/openid-configuration) controller serves the discovery document only when the request issuer matches the configured OIDC issuer for the requested endpoints. If isIssuerValidForEndpoint fails, CAS logs this warning and returns HTTP 404 NOT_FOUND instead of the discovery JSON.","triggerScenarios":"GET to the well-known discovery endpoint(s) where the request URL's issuer component does not validate against cas.authn.oidc.issuer for the listed endpoints.","commonSituations":"RP configured with the wrong discovery URL (hostname/protocol mismatch with issuer); proxy stripping the original host; clients querying an alternate well-known path; cas.authn.oidc.issuer containing an unsupported path/pattern.","solutions":["Point the RP's discovery URL at the exact issuer base (issuer + '/.well-known/openid-configuration')","Align cas.authn.oidc.issuer with the externally visible URL (scheme/host/port/path)","Fix proxy/load-balancer Host and X-Forwarded-* header forwarding","Check CAS logs for the determineIssuer value to see what issuer CAS actually derived"],"exampleFix":"// before\ncurl https://internal-host:8443/cas/oidc/.well-known/openid-configuration   # issuer is https://sso.example.org/cas/oidc\n// after\ncurl https://sso.example.org/cas/oidc/.well-known/openid-configuration","handlingStrategy":"validation","validationCode":"const wellKnown = new URL(casAuthnOidcIssuer + '/.well-known/openid-configuration');\nif (new URL(discoveryUrl).origin !== wellKnown.origin) {\n  throw new Error(`Discovery URL origin must match issuer origin ${wellKnown.origin}`);\n}","typeGuard":null,"tryCatchPattern":"const res = await fetch(discoveryUrl);\nif (res.status === 404) {\n  // issuer mismatch: rebuild discoveryUrl from the configured cas.authn.oidc.issuer\n}","preventionTips":["Derive the discovery URL programmatically from the issuer string","Keep issuer and external hostname in sync","Preserve proxy headers","Verify with curl through the exact URL the RP uses"],"tags":["oidc","discovery","issuer","http-404"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}