{"record":{"id":"1c0c2a636bf833c2","repo":"apereo/cas","slug":"resource-cannot-be-located","errorCode":null,"errorMessage":"Resource [{}] cannot be located","messagePattern":"Resource \\[(.+?)\\] cannot be located","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/SamlUtils.java","lineNumber":286,"sourceCode":"        try {\n            val resource = resourceLoader.getResource(signatureResourceLocation);\n            return buildSignatureValidationFilter(resource);\n        } catch (final Exception e) {\n            LOGGER.debug(e.getMessage(), e);\n        }\n        return null;\n    }\n\n    /**\n     * Build signature validation filter if needed.\n     *\n     * @param signatureResourceLocation the signature resource location\n     * @return the metadata filter\n     * @throws Exception the exception\n     */\n    public static @Nullable SignatureValidationFilter buildSignatureValidationFilter(final Resource signatureResourceLocation) throws Exception {\n        if (!ResourceUtils.doesResourceExist(signatureResourceLocation)) {\n            LOGGER.warn(\"Resource [{}] cannot be located\", signatureResourceLocation);\n            return null;\n        }\n\n        val keyInfoProviderList = new ArrayList<KeyInfoProvider>(4);\n        keyInfoProviderList.add(new RSAKeyValueProvider());\n        keyInfoProviderList.add(new DSAKeyValueProvider());\n        keyInfoProviderList.add(new DEREncodedKeyValueProvider());\n        keyInfoProviderList.add(new InlineX509DataProvider());\n\n        LOGGER.debug(\"Attempting to resolve credentials from [{}]\", signatureResourceLocation);\n        val credential = buildCredentialForMetadataSignatureValidation(signatureResourceLocation);\n        LOGGER.info(\"Successfully resolved credentials from [{}]\", signatureResourceLocation);\n        Objects.requireNonNull(credential, \"No credential found\");\n\n        LOGGER.debug(\"Configuring credential resolver for key signature trust engine @ [{}]\",\n            credential.getCredentialType().getSimpleName());\n        val resolver = new StaticCredentialResolver(credential);\n        val keyInfoResolver = new BasicProviderKeyInfoCredentialResolver(keyInfoProviderList);","sourceCodeStart":268,"sourceCodeEnd":304,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-core-api/src/main/java/org/apereo/cas/support/saml/SamlUtils.java#L268-L304","documentation":"SamlUtils.buildSignatureValidationFilter() loads SAML metadata signing/validation material from the given Resource. If the resource does not exist or is unreadable, it logs this warning and returns null, meaning no signature validation filter will be built. Callers must handle the null filter or metadata signatures will not be validated as intended.","triggerScenarios":"Passing a signature metadata Resource whose file path is wrong, the file is missing on disk, or the classpath:/http: location cannot be resolved by ResourceUtils.doesResourceExist.","commonSituations":"Typo in the signature metadata file path in cas.authn.saml properties; the signing certificate/metadata file was moved or deleted after deployment; running in a container where the mounted metadata volume is absent; classpath resource not packaged into the WAR.","solutions":["Verify the configured resource path exists and is readable by the CAS process (check container volume mounts)","Fix the cas.authn.saml.* signature-metadata property to point at the correct file/classpath location","Handle the null return: decide whether failing fast (throw) is safer than silently skipping signature validation","Re-deploy including the resource if it was supposed to be on the classpath"],"exampleFix":"// before: silently null filter\nval filter = SamlUtils.buildSignatureValidationFilter(resource);\n// after: guard first\nif (!ResourceUtils.doesResourceExist(resource)) {\n    throw new FileNotFoundException(resource.getFilename());\n}\nval filter = SamlUtils.buildSignatureValidationFilter(resource);","handlingStrategy":"validation","validationCode":"// precheck the resource before building the filter\nif (!ResourceUtils.doesResourceExist(signatureResource)) {\n    throw new FileNotFoundException(signatureResource.getDescription());\n}","typeGuard":"function hasFilter(f) { return f != null; }","tryCatchPattern":"val filter = SamlUtils.buildSignatureValidationFilter(res);\nif (filter == null) throw new IllegalStateException('signature metadata missing: ' + res);","preventionTips":["Verify the signature resource path exists in every deployment environment","Include classpath metadata files in the build artifact","Fail fast on null filter instead of silently skipping signature validation"],"tags":["saml","file-not-found","metadata","signature-validation"],"backgroundTag":"file-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}