{"record":{"id":"2a13f6b3f8cc58a1","repo":"apereo/cas","slug":"skipped-metadata-signaturevalidationfilter-since-s","errorCode":null,"errorMessage":"Skipped metadata SignatureValidationFilter since signature cannot be located for [{}]","messagePattern":"Skipped metadata SignatureValidationFilter since signature cannot be located for \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/cache/resolver/BaseSamlRegisteredServiceMetadataResolver.java","lineNumber":128,"sourceCode":"            filter.initialize();\n            metadataFilterList.add(filter);\n            LOGGER.debug(\"Added metadata predicate filter with direction [{}] and entity attribute conditions [{}]\",\n                service.getMetadataCriteriaDirection(), conditions);\n        }\n    }\n\n    private static void addSignatureValidationFilterIfNeeded(final SamlRegisteredService service,\n                                                             @Nullable final SignatureValidationFilter signatureValidationFilter,\n                                                             final List<MetadataFilter> metadataFilterList) throws Exception {\n        if (signatureValidationFilter != null) {\n            if (!signatureValidationFilter.isInitialized()) {\n                signatureValidationFilter.setRequireSignedRoot(service.isRequireSignedRoot());\n                signatureValidationFilter.initialize();\n            }\n            metadataFilterList.add(signatureValidationFilter);\n            LOGGER.debug(\"Added metadata SignatureValidationFilter for [{}]\", service.getServiceId());\n        } else {\n            LOGGER.warn(\"Skipped metadata SignatureValidationFilter since signature cannot be located for [{}]\", service.getServiceId());\n        }\n    }\n\n    protected static void buildEntityDescriptorCertificatesExpirationFilterIfNeeded(\n        final SamlRegisteredService service,\n        final List<MetadataFilter> metadataFilterList) throws Exception {\n        if (service.isValidateMetadataCertificates()) {\n            val filter = new EntityDescriptorCertificatesExpirationFilter();\n            filter.initialize();\n            metadataFilterList.add(filter);\n            LOGGER.debug(\"Added EntityDescriptorCertificatesExpirationFilter for [{}]\", service.getServiceId());\n        }\n    }\n\n    protected static void buildSignatureValidationFilterIfNeeded(final SamlRegisteredService service,\n                                                                 final List<MetadataFilter> metadataFilterList)\n        throws Exception {\n        if (StringUtils.isBlank(service.getMetadataSignatureLocation())) {","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/cache/resolver/BaseSamlRegisteredServiceMetadataResolver.java#L110-L146","documentation":"This is a WARN log from BaseSamlRegisteredServiceMetadataResolver.addSignatureValidationFilterIfNeeded, emitted when the service requests signature validation but no signature verification key/certificate can be located in its configuration. The SignatureValidationFilter is skipped entirely, so incoming metadata signatures are NOT verified for that service — a security-relevant downgrade. Metadata processing continues without signature enforcement.","triggerScenarios":"Building a metadata resolver for a SamlRegisteredService with metadata signature validation enabled (isSignatureValidated or require-signed-metadata), but the signature verification key property (e.g. metadataSignatureValidationPublicKey / keystore-based cert) is unset, blank, or unreadable, so the code takes the else branch.","commonSituations":"Operator enabled 'require signed metadata' but forgot to upload the IdP/SP signing certificate; key file path wrong or unreadable by the CAS process; certificate stored in a keystore alias that does not exist; service cloned from a template that left the signing cert field empty.","solutions":["Configure the signature verification certificate/key for the service (metadataSignatureValidationPublicKey or equivalent) in the service definition.","Verify the key file path exists and is readable by the CAS process user.","If using a keystore, confirm the alias and password resolve to a valid certificate.","Re-save and reload the service, then confirm the DEBUG log 'Added metadata SignatureValidationFilter' appears.","Do not ignore this warning in production if signed metadata is a security requirement; treat it as a misconfiguration."],"exampleFix":"// before: signature validation requested but no key configured\n{\n  \"@class\": \"org.apereo.cas.support.saml.services.SamlRegisteredService\",\n  \"serviceId\": \"https://sp.example.org/metadata\",\n  \"requireSignedRoot\": true\n}\n// after\n{\n  \"@class\": \"org.apereo.cas.support.saml.services.SamlRegisteredService\",\n  \"serviceId\": \"https://sp.example.org/metadata\",\n  \"requireSignedRoot\": true,\n  \"metadataSignatureValidationPublicKey\": \"file:/etc/cas/sp-signing.crt\"\n}","handlingStrategy":"validation","validationCode":"// Verify signing material exists before saving a service that requires signed metadata\nString keyPath = service.getMetadataSignatureValidationPublicKey();\nif (service.isRequireSignedRoot() && (keyPath == null || !new java.io.File(\n        new java.net.URI(keyPath.replace(\"file:\", \"\")).getPath()).canRead())) {\n    throw new IllegalStateException(\"Signed metadata required but signing key missing/unreadable for \" + service.getServiceId());\n}","typeGuard":null,"tryCatchPattern":"try {\n    var resolver = baseResolver.buildMetadataResolver(service, metadataFilters);\n} catch (Exception e) {\n    LOGGER.error(\"Failed to build metadata resolver with signature validation for {}\", service.getServiceId(), e);\n}","preventionTips":["Refuse to enable 'require signed metadata' on a service without uploading its verification certificate","Check that certificate file paths are absolute and readable by the CAS runtime user","After saving the service, confirm the DEBUG log 'Added metadata SignatureValidationFilter' appears","Never dismiss this WARN in security-sensitive deployments; the filter being skipped means unsigned metadata is accepted"],"tags":["saml","signature-validation","security","metadata-filter"],"backgroundTag":"missing-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}