{"record":{"id":"30d8662414491faf","repo":"apereo/cas","slug":"unable-to-resolve-service-provider-assertion-consu","errorCode":null,"errorMessage":"Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: [{}]","messagePattern":"Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java","lineNumber":162,"sourceCode":" val builder = (SAMLObjectBuilder) builderFactory.getBuilder(qname);\n return clazz.cast(Objects.requireNonNull(builder).buildObject());\n }\n\n protected String extractShire(final HttpServletRequest request, final String providerId,\n final SamlRegisteredServiceMetadataAdaptor facade)\n throws MessageDecodingException {\n var shire = request.getParameter(SamlIdPConstants.SHIRE);\n if (StringUtils.isBlank(shire)) {\n LOGGER.info(\"Resolving service provider assertion consumer service URL for [{}] and binding [{}]\",\n providerId, SAMLConstants.SAML2_POST_BINDING_URI);\n val acs = facade.getAssertionConsumerService(SAMLConstants.SAML2_POST_BINDING_URI);\n shire = Optional.ofNullable(acs)\n .map(service -> StringUtils.isBlank(service.getResponseLocation())\n ? service.getLocation()\n : service.getResponseLocation()).orElse(null);\n }\n if (StringUtils.isBlank(shire)) {\n LOGGER.warn(\"Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: [{}]\", providerId);\n throw new MessageDecodingException(\"Unable to resolve SP ACS URL for AuthnRequest construction\");\n }\n return shire;\n }\n\n protected String extractProviderId(final HttpServletRequest request) throws MessageDecodingException {\n val providerId = request.getParameter(SamlIdPConstants.PROVIDER_ID);\n if (StringUtils.isBlank(providerId)) {\n LOGGER.warn(\"No providerId parameter given in unsolicited SSO authentication request.\");\n throw new MessageDecodingException(\"Missing providerId\");\n }\n return providerId;\n }\n}\n","sourceCodeStart":144,"sourceCodeEnd":177,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java#L144-L177","documentation":"During unsolicited (IdP-initiated) SSO, CAS resolved the SP's metadata but could not determine the Assertion Consumer Service (ACS) URL ('shire') to build the AuthnRequest. The chosen AssertionConsumerService had neither a usable ResponseLocation nor Location, or no ACS was present at all, so MessageDecodingException is thrown. CAS refuses to guess an ACS endpoint.","triggerScenarios":"extractShire looks up the SP's AssertionConsumerService for the given providerId/entityID; the optional chain yields blank/null when metadata has no matching AssertionConsumerService entry, or the entry's location and responseLocation are both empty/missing.","commonSituations":"SP metadata lacks an AssertionConsumerService element (common with hand-written or minimal metadata); IdP-initiated request specifies an ACS index/binding not present in SP metadata; entityID resolves to the wrong EntityDescriptor; white/black-listed ACS filtering in CAS service config excludes the SP's declared ACS.","solutions":["Add or correct the AssertionConsumerService (with Binding and Location, optionally ResponseLocation) in the SP's metadata so CAS can resolve an ACS URL.","If the request supplies an ACS index, ensure the SP metadata contains an AssertionConsumerService at that index with the right binding.","Check CAS SamlRegisteredService settings (e.g. assertionConsumerService URLs / white/black lists) are not filtering out the SP's ACS.","Verify the providerId/entityID parameter resolves to the intended EntityDescriptor — a wrong match may select an entity without an ACS.","Inspect DEBUG logs for the metadata adaptor's resolved EntityDescriptor to confirm what ACS entries were seen."],"exampleFix":"// before: SP metadata without ACS\n\n// after: declare the ACS\n\n \n","handlingStrategy":"validation","validationCode":"// Pre-check SP metadata exposes at least one ACS with a Location\nval entity = metadataResolver.resolveSingle(criteria(issuer));\nboolean acsOk = entity.getSPSSODescriptor(SAML_20_NS).getAssertionConsumerServices().stream()\n .anyMatch(acs -> StringUtils.isNotBlank(acs.getLocation()));\nif (!acsOk) throw new IllegalStateException(\"SP metadata has no usable ACS for \" + issuer);","typeGuard":"boolean hasAcsLocation(EntityDescriptor ed) { return Optional.ofNullable(ed)\n .map(e -> e.getSPSSODescriptor(SAML20P_NS))\n .map(sp -> sp.getAssertionConsumerServices())\n .map(list -> list.stream().anyMatch(a -> StringUtils.isNotBlank(a.getLocation())))\n .orElse(false); }","tryCatchPattern":"try {\n shire = extractShire(request, providerId);\n} catch (MessageDecodingException e) {\n LOGGER.error(\"No ACS resolvable for entityID {}\", providerId, e);\n // return a clear error to the requesting application\n}","preventionTips":["Require SP metadata to declare an AssertionConsumerService before onboarding.","If IdP-initiated SSO is used, verify the ACS index/binding exists in SP metadata.","Check CAS service white/black ACS lists whenever SP metadata changes."],"tags":["saml","metadata","acs-url","unsolicited-sso","cas"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}