{"record":{"id":"1df7c20fedaed01b","repo":"spring-projects/spring-security","slug":"relying-party-registration-not-found-1df7c2","errorCode":"relying_party_registration_not_found","errorMessage":"registration not found","messagePattern":"registration not found","errorType":"error_code","errorClass":"Saml2AuthenticationException","httpStatus":401,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/BaseOpenSamlLogoutRequestValidatorParametersResolver.java","lineNumber":157,"sourceCode":"\t\t\treturn registrationId;\n\t\t}\n\t\tif (authentication == null) {\n\t\t\treturn null;\n\t\t}\n\t\tif (authentication instanceof Saml2AssertionAuthentication saml2) {\n\t\t\treturn saml2.getRelyingPartyRegistrationId();\n\t\t}\n\t\tif (authentication.getPrincipal() instanceof Saml2AuthenticatedPrincipal saml2) {\n\t\t\treturn saml2.getRelyingPartyRegistrationId();\n\t\t}\n\t\treturn null;\n\t}\n\n\tprivate @Nullable Saml2LogoutRequestValidatorParameters logoutRequestById(HttpServletRequest request,\n\t\t\t@Nullable Authentication authentication, String registrationId) {\n\t\tRelyingPartyRegistration registration = this.registrations.findByRegistrationId(registrationId);\n\t\tif (registration == null) {\n\t\t\tthrow new Saml2AuthenticationException(\n\t\t\t\t\tSaml2Error.relyingPartyRegistrationNotFound(\"registration not found\"));\n\t\t}\n\t\treturn logoutRequestByRegistration(request, registration, authentication);\n\t}\n\n\tprivate @Nullable Saml2LogoutRequestValidatorParameters logoutRequestByEntityId(HttpServletRequest request,\n\t\t\t@Nullable Authentication authentication) {\n\t\tString serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST);\n\t\tLogoutRequest logoutRequest = this.saml.deserialize(\n\t\t\t\tSaml2Utils.withEncoded(serialized).inflate(HttpMethod.GET.matches(request.getMethod())).decode());\n\t\tIssuer issuer = logoutRequest.getIssuer();\n\t\tAssert.notNull(issuer, \"LogoutRequest#Issuer cannot be null\");\n\t\tRelyingPartyRegistration registration = this.registrations.findUniqueByAssertingPartyEntityId(getValue(issuer));\n\t\treturn logoutRequestByRegistration(request, registration, authentication);\n\t}\n\n\tprivate @Nullable Saml2LogoutRequestValidatorParameters logoutRequestByRegistration(HttpServletRequest request,\n\t\t\t@Nullable RelyingPartyRegistration registration, @Nullable Authentication authentication) {","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/BaseOpenSamlLogoutRequestValidatorParametersResolver.java#L139-L175","documentation":"BaseOpenSamlLogoutRequestValidatorParametersResolver.logoutRequestById looked up a RelyingPartyRegistration by the registrationId in the logout request (e.g. from the request parameter or path) and got null, so it throws Saml2AuthenticationException with code relying_party_registration_not_found and message 'registration not found'. Called from resolve when the registration id is supplied explicitly.","triggerScenarios":"A SLO request/response arrives (or resolve() is called) with a registrationId that has no RelyingPartyRegistration in the configured RelyingPartyRegistrationRepository.","commonSituations":"Logout link built with a stale/typo'd registrationId; registration renamed after users have existing sessions; different config across cluster nodes; metadata-driven registrations not loaded at logout time.","solutions":["Ensure the registrationId used in the logout request matches one registered in the RelyingPartyRegistrationRepository","Fix the URLs/templates that generate logout links (e.g. /logout/saml2/sso?registrationId=...)","Synchronize saml2 RelyingPartyRegistration configuration across all application instances","Log available registration ids at startup and compare against incoming ids"],"exampleFix":"// before (template with wrong id)\n<a th:href=\"@{/logout/saml2/sso?registrationId=idp1}\">Logout</a>\n// after: derive the id from the actual registration\n<a th:href=\"@{/logout/saml2/sso?registrationId=${saml2RegistrationId}}\">Logout</a>","handlingStrategy":"try-catch","validationCode":"if (registrations.findByRegistrationId(registrationId) == null) {\n    throw new ResponseStatusException(HttpStatus.BAD_REQUEST, \"Unknown registrationId \" + registrationId);\n}","typeGuard":null,"tryCatchPattern":"try { /* resolve/logout flow */ } catch (Saml2AuthenticationException ex) {\n    if (\"relying_party_registration_not_found\".equals(ex.getSaml2Error().getErrorCode())) {\n        log.warn(\"Logout for unknown registration\", ex);\n        response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n    } else { throw ex; }\n}","preventionTips":["Generate logout links from the authenticated session's actual registrationId","Validate registrationId route/query params against the repository","Keep registration ids stable; never rename without migration"],"tags":["saml2","spring-security","logout","resource-not-found"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}