{"record":{"id":"4247dcee5519d470","repo":"apereo/cas","slug":"required-nameid-format-in-the-authn-request-i","errorCode":null,"errorMessage":"Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. The requested NameID format may not be honored. You should consult the metadata for this service and ensure the requested NameID format is present in the collection of supported metadata formats in the metadata, which are the following: [{}]","messagePattern":"Required NameID format \\[(.+?)\\] in the AuthN request issued by \\[(.+?)\\] is not supported based on the metadata for \\[(.+?)\\]\\. The requested NameID format may not be honored\\. You should consult the metadata for this service and ensure the requested NameID format is present in the collection of supported metadata formats in the metadata, which are the following: \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java","lineNumber":150,"sourceCode":"                }\n            }\n\n            if (!Strings.CI.equals(registeredService.getServiceProviderNameIdQualifier(), \"none\")\n                 && !registeredService.isSkipGeneratingServiceProviderNameIdQualifier()) {\n                FunctionUtils.doIf(StringUtils.isNotBlank(registeredService.getServiceProviderNameIdQualifier()),\n                        value -> nameid.setSPNameQualifier(registeredService.getServiceProviderNameIdQualifier()),\n                        value -> nameid.setSPNameQualifier(context.getAdaptor().getEntityId()))\n                    .accept(registeredService);\n            }\n        }\n        return nameid;\n    }\n\n    protected void validateRequiredNameIdFormatIfAny(final List<String> supportedNameFormats,\n                                                     final String requiredNameFormat,\n                                                     final SamlProfileBuilderContext context) {\n        if (StringUtils.isNotBlank(requiredNameFormat) && !supportedNameFormats.contains(requiredNameFormat)) {\n            LOGGER.warn(\"Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. \"\n                        + \"The requested NameID format may not be honored. You should consult the metadata for this service \"\n                        + \"and ensure the requested NameID format is present in the collection of supported \"\n                        + \"metadata formats in the metadata, which are the following: [{}]\",\n                requiredNameFormat, SamlIdPUtils.getIssuerFromSamlObject(context.getSamlRequest()),\n                context.getAdaptor().getEntityId(), context.getAdaptor().getSupportedNameIdFormats());\n        }\n    }\n\n    protected NameID determineNameId(final List<String> supportedNameFormats, final SamlProfileBuilderContext context) {\n        for (val nameFormat : supportedNameFormats) {\n            LOGGER.debug(\"Evaluating NameID format [{}]\", nameFormat);\n            val nameId = encodeNameIdBasedOnNameFormat(context, nameFormat);\n            if (nameId != null) {\n                LOGGER.debug(\"Determined NameID based on format [{}] to be [{}]\", nameFormat, nameId.getValue());\n                return nameId;\n            }\n        }\n        LOGGER.warn(\"No NameID could be determined based on the supported formats [{}]\", supportedNameFormats);","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java#L132-L168","documentation":"The SP's AuthnRequest requested a specific NameID Format, but that format is not among the NameID formats the SAML IdP metadata adapter supports for this service. This is a warning: the IdP proceeds with a supported format and the requested format may not be honored, which can break SPs that strictly validate the returned NameID format.","triggerScenarios":"validateRequiredNameIdFormatIfAny is invoked from buildNameId with a non-blank requiredNameFormat extracted from the AuthnRequest that is not present in the service's supportedNameIdFormats (context.getAdaptor().getSupportedNameIdFormats()).","commonSituations":"SP requests transient/persistent/encrypted formats the IdP service config does not list; service metadata missing <NameIDFormat> entries; mismatch after changing the registered service's supportedNameIdFormats; SP hard-codes an unusual format like emailAddress while IdP is configured for unspecified.","solutions":["Add the requested NameID format to the registered service's supportedNameIdFormats","Adjust the SP's AuthnRequest to request a NameID format the IdP supports","Verify the SAML service metadata/adaptor exposes the formats you intend (getSupportedNameIdFormats)","If honoring the SP format is impossible, inform the SP owner to relax NameID format validation"],"exampleFix":"// before (service config)\n\"supportedNameIdFormats\": [\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\"]\n// after\n\"supportedNameIdFormats\": [\"urn:oasis:names:tc:SAML:2.0:nameid-format:persistent\",\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\"]","handlingStrategy":"validation","validationCode":"// Before the request round-trip, compare requested vs supported formats\nval requested = authnRequest.getNameIDPolicy() != null\n    ? authnRequest.getNameIDPolicy().getFormat() : null;\nif (requested != null && !service.getSupportedNameIdFormats().contains(requested)) {\n    LOGGER.warn(\"SP [{}] requests unsupported format [{}]\", service.getServiceId(), requested);\n}","typeGuard":null,"tryCatchPattern":"// Typically a warning, not an exception; if you re-throw on strict SPs:\ntry {\n    nameIdBuilder.build(context);\n} catch (SamlException e) {\n    LOGGER.error(\"NameID format mismatch for SP\", e);\n    // fail the request rather than emitting an unaccepted NameID\n}","preventionTips":["Keep the service's supportedNameIdFormats in sync with each SP's metadata NameIDFormat list","Test SP flows after changing NameID format configuration","Use transient/persistent formats widely supported across SPs","Review IdP logs for this warning during SP onboarding"],"tags":["saml","saml-idp","nameid","metadata","authn-request"],"backgroundTag":"unsupported-nameid-format","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}