{"record":{"id":"32994e985e9245b0","repo":"apereo/cas","slug":"no-federation-keys-defined-for-entity","errorCode":null,"errorMessage":"No federation keys defined for entity","messagePattern":"No federation keys defined for entity","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcFetchFederationEndpointController.java","lineNumber":88,"sourceCode":"        }\n\n        if (StringUtils.isBlank(sub)) {\n            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, \"Invalid entity\");\n            return new ResponseEntity<>(body, HttpStatus.BAD_REQUEST);\n        }\n\n        val foundSubordinate = subordinateRepository.getSubordinates().get(sub);\n        if (foundSubordinate == null) {\n            val body = OAuth20Utils.getErrorResponseBody(OAuth20Constants.INVALID_REQUEST, \"Invalid entity\");\n            return new ResponseEntity<>(body, HttpStatus.BAD_REQUEST);\n        }\n        val serviceMetadata = foundSubordinate.getMetadata();\n        if (serviceMetadata == null) {\n            throw new IllegalArgumentException(\"No metadata defined for entity\");\n        }\n        val federationKeys = foundSubordinate.getFederationKeys();\n        if (federationKeys == null || federationKeys.isEmpty()) {\n            throw new IllegalArgumentException(\"No federation keys defined for entity\");\n        }\n\n        val issuer = oidcProperties.getCore().getIssuer();\n        val metadata = (JSONObject) JSONValue.parse(serviceMetadata.toString());\n        return buildEntityStatement(issuer, sub, metadata, federationKeys, null);\n    }\n}\n","sourceCodeStart":70,"sourceCodeEnd":96,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcFetchFederationEndpointController.java#L70-L96","documentation":"fetchEntityStatement() also requires the subordinate's federation keys to sign/build the entity statement. If federationKeys is null or empty on the loaded subordinate, this IllegalArgumentException is thrown because an entity statement without signing keys cannot be produced.","triggerScenarios":"A fetch-entity request targets a subordinate whose JSON definition omits the federation-keys collection (or defines an empty list).","commonSituations":"Subordinate file created from a template without keys; keys removed during rotation but file not updated; typo in the JSON key so Jackson binds an empty/null list.","solutions":["Add the entity's public JWK set to the subordinate JSON's federation-keys field and reload","Generate a keypair and publish its public JWK into the subordinate definition if none exists","Confirm the JSON property name matches OidcFederationSubordinate.getFederationKeys() binding"],"exampleFix":"// before\n{ \"entityId\": \"https://op.example.org\", \"metadata\": {...} }\n// after\n{ \"entityId\": \"https://op.example.org\", \"metadata\": {...},\n  \"federationKeys\": { \"keys\": [ { \"kty\": \"RSA\", \"kid\": \"sig-1\", \"n\": \"...\", \"e\": \"AQAB\" } ] } }","handlingStrategy":"validation","validationCode":"val found = repository.findSubordinateByEntityId(entityId);\nif (found == null || found.getFederationKeys() == null || found.getFederationKeys().isEmpty()) {\n    throw new IllegalStateException(\"Subordinate missing federation keys: \" + entityId);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return controller.fetchEntityStatement(sub, request, response);\n} catch (IllegalArgumentException e) {\n    return ResponseEntity.badRequest().body(Map.of(\"error\", \"invalid_request\", \"detail\", e.getMessage()));\n}","preventionTips":["Ensure every subordinate definition carries a JWK set","Rotate keys by replacing, not removing, entries","Validate keys parse as JWK in CI"],"tags":["oidc-federation","crypto","configuration"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}