{"record":{"id":"380ab0febef9b93d","repo":"apereo/cas","slug":"unable-to-resolve-federated-service","errorCode":null,"errorMessage":"Unable to resolve federated service [{}]","messagePattern":"Unable to resolve federated service \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/validator/OpenIdFederationAuthorizationCodeResponseTypeAuthorizationRequestValidator.java","lineNumber":89,"sourceCode":"        if (!shouldRefreshTemporaryFederationService(registeredService)) {\n            return registeredService;\n        }\n        val serviceLock = SERVICE_LOCKS.computeIfAbsent(clientId, key -> new ReentrantLock());\n        serviceLock.lock();\n        try {\n            return resolveAndSaveFederatedService(clientId).orElse(registeredService);\n        } finally {\n            serviceLock.unlock();\n        }\n    }\n\n    private Optional<OAuthRegisteredService> resolveAndSaveFederatedService(final String clientId) {\n        try {\n            val resolvedService = oidcFederationTrustChainResolver.resolveTrustChains(clientId);\n            LOGGER.debug(\"Resolved service: [{}]\", resolvedService);\n            return resolvedService.map(service -> (OAuthRegisteredService) getServicesManager().save(service));\n        } catch (final Exception e) {\n            LoggingUtils.warn(LOGGER, \"Unable to resolve federated service [\" + clientId + \"]\", e);\n            return Optional.empty();\n        }\n    }\n\n    private static boolean shouldRefreshTemporaryFederationService(final OAuthRegisteredService registeredService) {\n        if (!registeredService.getProperties().containsKey(OidcFederationDefaultTrustChainResolver.TEMPORARY_OPENIDFEDERATION_SERVICE)) {\n            return false;\n        }\n        val expirationDate = registeredService.getExpirationPolicy().getExpirationDate();\n        val expiration = DateTimeUtils.zonedDateTimeOf(expirationDate);\n        val refresh = expiration.minus(SERVICE_EXPIRATION_REFRESH_WINDOW).isBefore(ZonedDateTime.now(Clock.systemUTC()));\n        LOGGER.debug(\"Should refresh: [{}] upfront: [{}]\", registeredService, refresh);\n        return refresh;\n    }\n\n    private static boolean isFederatedEntityId(final String clientId) {\n        if (StringUtils.isBlank(clientId)) {\n            return false;","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/validator/OpenIdFederationAuthorizationCodeResponseTypeAuthorizationRequestValidator.java#L71-L107","documentation":"OpenIdFederationAuthorizationCodeResponseTypeAuthorizationRequestValidator.resolveAndSaveFederatedService failed to resolve a federated OP/client from its entity ID via trust-chain resolution. The trust chain (entity statements from entity configuration endpoints) could not be validated or fetched, so no federated service is registered and the authorization request is rejected with 'Unable to resolve federated service [clientId]'.","triggerScenarios":"An authorization request arrives with a clientId that is not registered locally, so CAS calls resolveMissingFederatedService or refreshes a temporary federation service; oidcFederationTrustChainResolver.resolveTrustChains(clientId) throws or returns empty because the entity's .well-known/openid-federation endpoint is unreachable, the trust chain lacks a trust anchor, or signatures fail validation.","commonSituations":"Federation entity's entity configuration endpoint down or misconfigured DNS/TLS; trust anchors not configured in CAS to cover the entity; expired entity statement keys; trying federation without the federation feature properly enabled.","solutions":["Verify the client's entity configuration URL (https://host/.well-known/openid-federation) is reachable from CAS and returns a valid entity statement.","Configure the CAS OIDC federation trust anchors so the entity's trust chain terminates at an accepted anchor.","Register the relying party explicitly as a service if federation is not intended for it.","Check logs for the underlying exception via LoggingUtils to distinguish network vs signature/trust failures."],"exampleFix":"// before: entity unknown to any trust anchor\n// cas.authn.oidc.federation.trust-anchors= (empty)\n// after\n// cas.authn.oidc.federation.trust-anchors=https://trusted-anchor.example.org/.well-known/openid-federation","handlingStrategy":"validation","validationCode":"// Verify entity configuration reachability before relying on federation\nURL u = URI.create(\"https://client.example.org/.well-known/openid-federation\").toURL();\nHttpURLConnection c = (HttpURLConnection) u.openConnection();\nc.setConnectTimeout(5000);\nif (c.getResponseCode() != 200) throw new IllegalStateException(\"Entity config unreachable\");","typeGuard":null,"tryCatchPattern":"// Trust-chain resolution can fail transiently\ntry {\n    Optional<OAuthRegisteredService> svc = resolver.resolveTrustChains(clientId);\n    svc.orElseThrow(() -> new IllegalArgumentException(\"Unresolvable federated client \" + clientId));\n} catch (Exception e) {\n    LOGGER.warn(\"Federation resolution failed for {}\", clientId, e);\n}","preventionTips":["Pre-register critical relying parties explicitly instead of relying solely on dynamic federation","Monitor entity configuration endpoints of federation members","Keep trust anchors current and test chain resolution after anchor key rotation"],"tags":["oidc","openid-federation","trust-chain","network"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}