{"record":{"id":"1c4930daa37a0a8b","repo":"apereo/cas","slug":"unable-to-locate-acs-url-in-for-entity-and-bi","errorCode":null,"errorMessage":"Unable to locate acs url in for entity [{}] and binding [{}] with index [{}]","messagePattern":"Unable to locate acs url in for entity \\[(.+?)\\] and binding \\[(.+?)\\] with index \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java","lineNumber":290,"sourceCode":"        }\n        return Optional.empty();\n    }\n\n    private static @Nullable AssertionConsumerService getAssertionConsumerServiceFromRequest(final RequestAbstractType request,\n                                                                                             final String binding,\n                                                                                             final SamlRegisteredServiceMetadataAdaptor adapter) {\n        if (request instanceof final AuthnRequest authnRequest) {\n            var acsUrl = authnRequest.getAssertionConsumerServiceURL();\n            val acsIndex = authnRequest.getAssertionConsumerServiceIndex();\n            if (StringUtils.isBlank(acsUrl) && acsIndex == null) {\n                LOGGER.debug(\"No assertion consumer service url or index is supplied in the authentication request\");\n                return null;\n            }\n            if (StringUtils.isBlank(acsUrl) && acsIndex != null) {\n                LOGGER.debug(\"Locating assertion consumer service url for binding [{}] and index [{}]\", acsUrl, acsIndex);\n                acsUrl = adapter.getAssertionConsumerServiceFor(binding, acsIndex)\n                    .orElseGet(() -> {\n                        LOGGER.warn(\"Unable to locate acs url in for entity [{}] and binding [{}] with index [{}]\",\n                            adapter.getEntityId(), binding, acsIndex);\n                        return null;\n                    });\n            }\n\n            if (StringUtils.isNotBlank(acsUrl)) {\n                LOGGER.debug(\"Fetched assertion consumer service url [{}] with binding [{}] from authentication request\", acsUrl, binding);\n                val builder = new AssertionConsumerServiceBuilder();\n                val endpoint = builder.buildObject(AssertionConsumerService.DEFAULT_ELEMENT_NAME);\n                endpoint.setBinding(binding);\n                endpoint.setResponseLocation(acsUrl);\n                endpoint.setLocation(acsUrl);\n                endpoint.setIndex(acsIndex);\n                return endpoint;\n            }\n        }\n        return null;\n    }","sourceCodeStart":272,"sourceCodeEnd":308,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java#L272-L308","documentation":"SamlIdPUtils.getAssertionConsumerServiceFromRequest() resolves the ACS URL from a SAML request using either an explicit ACS URL or an ACS index for the given binding. When acsIndex is provided but the service provider metadata adapter has no AssertionConsumerService for that binding/index combination, it logs this warning and yields null, meaning no ACS endpoint could be determined. Callers typically reject the request or fall back to the default ACS.","triggerScenarios":"A SAML AuthnRequest carries an AssertionConsumerServiceIndex (or the caller passes acsIndex) that does not match any ACS entry declared for that binding in the SP metadata; the metadata for the entity is stale or missing that index.","commonSituations":"SP sends an index from an old metadata version after the IdP reloaded newer/older metadata; hand-written requests guessing an index; metadata not refreshed after the SP changed its ACS endpoints; binding mismatch between requested protocol and metadata entries.","solutions":["Compare the acsIndex in the request against the ACS entries in the SP's entity descriptor in the IdP metadata","Refresh/reload the SP metadata so the declared indexes match what the SP sends","Have the SP send an explicit AssertionConsumerServiceURL instead of relying on the index","Fix the SP configuration so the index matches a valid binding (e.g. POST vs Redirect) in its metadata"],"exampleFix":"// before: SP sends index 7 that IdP metadata lacks\nAssertionConsumerServiceIndex=\"7\"\n// after: send explicit URL or use a valid index\nAssertionConsumerServiceURL=\"https://sp.example.com/acs\"","handlingStrategy":"validation","validationCode":"// validate the requested index against SP metadata\nval valid = adapter.getAssertionConsumerServiceFor(binding, acsIndex);\nif (valid.isEmpty()) log.error('SP sent unknown ACS index ' + acsIndex);","typeGuard":"function hasAcs(url) { return typeof url === 'string' && url.length > 0; }","tryCatchPattern":"val acs = SamlIdPUtils.getAssertionConsumerServiceFromRequest(...);\nif (acs == null) { /* reject request or fall back to default ACS */ }","preventionTips":["Keep IdP metadata for the SP current; enable metadata refresh","Prefer explicit AssertionConsumerServiceURL over indexes in SP config","Ensure SP binding and index match a metadata ACS entry"],"tags":["saml","idp","acs","metadata","sp-configuration"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}