{"record":{"id":"180a99d7ebd57ee8","repo":"apereo/cas","slug":"endpoint-for-does-not-define-a-binding-or-locatio","errorCode":null,"errorMessage":"Endpoint for  does not define a binding or location for binding ","messagePattern":"Endpoint for  does not define a binding or location for binding ","errorType":"exception","errorClass":"SamlException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java","lineNumber":124,"sourceCode":"                                                       final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                       final String binding) {\n        var endpoint = (Endpoint) null;\n        val authnRequest = authnContext.getLeft();\n        if (authnRequest instanceof LogoutRequest) {\n            endpoint = adaptor.getSingleLogoutService(binding);\n        } else {\n            val acsEndpointFromReq = getAssertionConsumerServiceFromRequest(authnRequest, binding, adaptor);\n            val acsEndpointFromMetadata = adaptor.getAssertionConsumerService(binding);\n            endpoint = determineEndpointForRequest(authnRequest, adaptor, binding,\n                acsEndpointFromReq, acsEndpointFromMetadata, authnContext.getRight());\n        }\n        if (endpoint == null) {\n            throw new SamlException(\"Endpoint for \" + authnRequest.getSchemaType()\n                + \" is not available or does not define a binding for \" + binding);\n        }\n        val missingLocation = StringUtils.isBlank(endpoint.getResponseLocation()) && StringUtils.isBlank(endpoint.getLocation());\n        if (StringUtils.isBlank(endpoint.getBinding()) || missingLocation) {\n            throw new SamlException(\"Endpoint for \" + authnRequest.getSchemaType()\n                + \" does not define a binding or location for binding \" + binding);\n        }\n        return endpoint;\n    }\n\n    private static AssertionConsumerService determineEndpointForRequest(final RequestAbstractType authnRequest,\n                                                                        final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                                        final String binding,\n                                                                        @Nullable final AssertionConsumerService acsFromRequest,\n                                                                        final AssertionConsumerService acsFromMetadata,\n                                                                        final MessageContext authenticationContext) {\n        LOGGER.trace(\"ACS from authentication request is [{}], ACS from metadata is [{}] with binding [{}]\",\n            acsFromRequest, acsFromMetadata, binding);\n\n        if (acsFromRequest != null) {\n            if (!authnRequest.isSigned() && !SAMLBindingSupport.isMessageSigned(authenticationContext)) {\n                val locations = StringUtils.isNotBlank(binding)\n                    ? adaptor.getAssertionConsumerServiceLocations(binding)","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java#L106-L142","documentation":"In SamlIdPUtils.determineEndpointForRequest(), an Endpoint was found for the binding but it is unusable: either getBinding() is blank, or both getResponseLocation() and getLocation() are blank. CAS throws SamlException because a response cannot be delivered to an endpoint without a binding and location.","triggerScenarios":"The metadata AssertionConsumerService or selected endpoint matching the binding has a Binding attribute or Location/ResponseLocation attribute missing/empty in the SP's SPSSODescriptor.","commonSituations":"Hand-edited or generated metadata with an ACS entry missing the Location attribute, a template that left Location blank, or metadata transformations that dropped attributes.","solutions":["Open the SP metadata and ensure the selected <md:AssertionConsumerService> (or endpoint for that binding) has non-empty Binding and Location attributes.","Regenerate/re-import the SP metadata from the vendor instead of hand-maintaining it.","If using ResponseLocation-only endpoints (e.g. some Artifact endpoints), also set Location, since CAS requires at least one of the two.","Validate metadata with an XML schema validator before publishing it to CAS."],"exampleFix":"// before\n<md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" index=\"0\"/>\n\n// after\n<md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://sp.example.com/acs\" index=\"0\"/>","handlingStrategy":"validation","validationCode":"// validate metadata ACS entries at load time\nacsList.forEach(acs -> {\n    if (acs.getLocation() == null || acs.getLocation().isBlank())\n        throw new SamlException(\"ACS index \" + acs.getIndex() + \" has no Location\");\n    if (acs.getBinding() == null || acs.getBinding().isBlank())\n        throw new SamlException(\"ACS index \" + acs.getIndex() + \" has no Binding\");\n});","typeGuard":null,"tryCatchPattern":"try {\n    endpoint = determineEndpointForRequest(authnRequest, adaptor, binding, fromReq, fromMeta, ctx);\n} catch (SamlException e) {\n    logger.error(\"Endpoint incomplete for {}: {}\", adaptor.getEntityId(), e.getMessage());\n}","preventionTips":["Schema-validate metadata so ACS entries cannot lack Binding/Location attributes.","Reject metadata documents missing Location at import time.","Prefer vendor-generated metadata over hand-edited files."],"tags":["saml","idp","metadata","endpoint","empty-location"],"backgroundTag":"empty-required-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}