{"record":{"id":"17fbdf4c8e12d77e","repo":"apereo/cas","slug":"cannot-find-entity-in-metadata-provider-for-c","errorCode":null,"errorMessage":"Cannot find entity [{}] in metadata provider for criteria [{}]","messagePattern":"Cannot find entity \\[(.+?)\\] in metadata provider for criteria \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/SamlRegisteredServiceMetadataAdaptor.java","lineNumber":108,"sourceCode":"        final SamlRegisteredServiceCachingMetadataResolver resolver,\n        final SamlRegisteredService registeredService,\n        final String entityID,\n        final CriteriaSet criteriaSet) {\n        try {\n            LOGGER.trace(\"Adapting SAML metadata for CAS service [{}] issued by [{}]\", registeredService.getName(), entityID);\n            criteriaSet.add(new EntityIdCriterion(entityID), true);\n            LOGGER.debug(\"Locating metadata for entityID [{}] by attempting to run through the metadata chain...\", entityID);\n            val cachedResult = Objects.requireNonNull(resolver.resolve(registeredService, criteriaSet),\n                () -> \"Metadata resolution resulted in a null metadata resolver entry for entity id %s\".formatted(entityID));\n            \n            Assert.isTrue(cachedResult.isResolved(), \"Metadata resolution resulted in an unknown metadata resolver entry for entity id %s\".formatted(entityID));\n            val cachedMetadataResolver = cachedResult.getMetadataResolver();\n            LOGGER.debug(\"Resolved metadata chain from [{}] using [{}]. Filtering the chain by entity ID [{}]\",\n                registeredService.getMetadataLocation(), cachedMetadataResolver.getId(), entityID);\n\n            val entityDescriptor = cachedMetadataResolver.resolveSingle(criteriaSet);\n            if (entityDescriptor == null) {\n                LOGGER.warn(\"Cannot find entity [{}] in metadata provider for criteria [{}]\", entityID, criteriaSet);\n                return Optional.empty();\n            }\n            LOGGER.trace(\"Located entity descriptor in metadata for [{}]\", entityID);\n\n            if (entityDescriptor.getValidUntil() != null) {\n                val expired = entityDescriptor.getValidUntil()\n                    .isBefore(ZonedDateTime.now(ZoneOffset.UTC).toInstant());\n                if (expired) {\n                    LOGGER.warn(\"Entity descriptor in the metadata has expired at [{}]\", entityDescriptor.getValidUntil());\n                    return Optional.empty();\n                }\n            }\n            return getAdaptor(entityID, cachedMetadataResolver, entityDescriptor);\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }\n        return Optional.empty();\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/SamlRegisteredServiceMetadataAdaptor.java#L90-L126","documentation":"During SAML IdP metadata resolution, the chaining metadata resolver was queried with a criteria set for a specific entityID, but resolveSingle() returned null — no EntityDescriptor for that entity exists in the configured metadata provider(s). The adaptor logs a warning and returns Optional.empty() rather than throwing, because the metadata aggregate loaded fine but simply does not contain that SP's entity ID.","triggerScenarios":"Calling SamlRegisteredServiceMetadataAdaptor.get(entityID, ...) (via SamlRegisteredServiceCachingMetadataResolver.get) where the criteria set (entity ID, RolesDescriptor, SPSSODescriptor) matches no entity in the metadata loaded from registeredService.getMetadataLocation().","commonSituations":"Wrong entityID configured on the CAS SAML service vs. what the SP published in its metadata; stale/aggregate metadata file or URL that no longer contains the SP; typo or case mismatch in entityID; metadata location points to an aggregate missing this SP; SP changed its entityID after a software upgrade.","solutions":["Compare the entityID on the CAS registered service with the entityID in the metadata document at the configured metadataLocation (grep for <EntityDescriptor entityID=...>).","Re-download/refresh the metadata source (URL may serve an outdated aggregate) and clear the metadata resolver cache so CAS reloads it.","Verify the metadataLocation (file/URL/HTTP/Classpath resource) on the SamlRegisteredService points to the intended provider.","If the SP intentionally changed entity IDs, update the SP metadata and the CAS service entityID together.","Enable debug logging for org.apereo.cas.support.saml to see which metadata chain was resolved and confirm the expected entity is absent."],"exampleFix":"// before (service config)\n// entityId: https://sp.example.org/sso/old\n// after\n// entityId: https://sp.example.org/saml/sp (matches <EntityDescriptor entityID=\"https://sp.example.org/saml/sp\"> in metadata)","handlingStrategy":"validation","validationCode":"// Before registering the service, verify the entity exists in the metadata source\nvar resolver = SamlMetadataResolverUtils.getMetadataResolverForRegisteredService(casProperties, samlIdPMetadataResolver, registeredService);\nvar found = resolver.resolveSingle(new CriteriaSet(new EntityIdCriterion(service.getEntityId())));\nif (found == null) {\n    throw new IllegalStateException(\"Metadata at \" + service.getMetadataLocation()\n        + \" does not contain entity \" + service.getEntityId());\n}","typeGuard":"boolean metadataContainsEntity(EntityDescriptor descriptor, String entityID) {\n    return descriptor != null && entityID != null && entityID.equals(descriptor.getEntityID());\n}","tryCatchPattern":"return metadataResolver.get(service, entityID)\n    .map(adaptor -> process(adaptor))\n    .orElseGet(() -> {\n        log.warn(\"No metadata for entity {} — check entityID and metadataLocation\", entityID);\n        return fallbackResponse();\n    });","preventionTips":["Always copy the entityID verbatim from the SP metadata XML into the CAS service definition.","Pin the metadata source to the SP's published metadata URL so it stays in sync.","Validate metadata with an XML signature/XMLOnline validator before registering.","Grep the metadata file for the entityID as a quick sanity check during onboarding."],"tags":["saml","metadata","entity-not-found","idp"],"backgroundTag":"entity-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}