{"record":{"id":"472c62496e362e57","repo":"apereo/cas","slug":"could-not-locate-metadata-for-to-process-attr","errorCode":null,"errorMessage":"Could not locate metadata for [{}] to process attributes","messagePattern":"Could not locate metadata for \\[(.+?)\\] to process attributes","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/BaseSamlRegisteredServiceAttributeReleasePolicy.java","lineNumber":37,"sourceCode":"@Slf4j\npublic abstract class BaseSamlRegisteredServiceAttributeReleasePolicy extends ReturnAllowedAttributeReleasePolicy {\n    @Serial\n    private static final long serialVersionUID = -3301632236702329694L;\n    \n    @Override\n    public Map<String, List<Object>> getAttributesInternal(final RegisteredServiceAttributeReleasePolicyContext context,\n                                                           final Map<String, List<Object>> attributes) {\n        if (context.getRegisteredService() instanceof SamlRegisteredService) {\n            val applicationContext = context.getApplicationContext();\n            val resolver = applicationContext.getBean(SamlRegisteredServiceCachingMetadataResolver.BEAN_NAME,\n                SamlRegisteredServiceCachingMetadataResolver.class);\n            val entityId = SamlIdPSAttributeReleasePolicyUtils.getEntityIdFromRequest(context);\n            val facade = StringUtils.isBlank(entityId)\n                ? Optional.<SamlRegisteredServiceMetadataAdaptor>empty()\n                : SamlIdPSAttributeReleasePolicyUtils.determineServiceProviderMetadataFacade(context, entityId);\n\n            if (facade.isEmpty()) {\n                LOGGER.warn(\"Could not locate metadata for [{}] to process attributes\", entityId);\n                return new HashMap<>();\n            }\n\n            val entityDescriptor = facade.get().getEntityDescriptor();\n            return getAttributesForSamlRegisteredService(attributes, resolver, facade.get(), entityDescriptor, context);\n        }\n        return authorizeReleaseOfAllowedAttributes(context, attributes);\n    }\n\n    protected abstract Map<String, List<Object>> getAttributesForSamlRegisteredService(\n        Map<String, List<Object>> attributes,\n        SamlRegisteredServiceCachingMetadataResolver resolver,\n        SamlRegisteredServiceMetadataAdaptor facade,\n        EntityDescriptor entityDescriptor,\n        RegisteredServiceAttributeReleasePolicyContext context);\n}\n","sourceCodeStart":19,"sourceCodeEnd":54,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/BaseSamlRegisteredServiceAttributeReleasePolicy.java#L19-L54","documentation":"BaseSamlRegisteredServiceAttributeReleasePolicy.getAttributesInternal() resolves the SP metadata facade for the entity id extracted from the request before computing released attributes. When the entity id is blank or no metadata adaptor can be found for it, it logs this warning and returns an empty attribute map, releasing no attributes rather than failing the flow.","triggerScenarios":"Attribute release is evaluated for a SAML response whose requester entity id is absent from the request context, or determineServiceProviderMetadataFacade cannot find metadata for that entity id in the configured metadata resolvers.","commonSituations":"SP's entityID not present in the loaded IdP metadata (metadata not yet loaded/refreshed); attribute release policy applied outside a SAML request context so no entity id is extractable; mismatched entityID casing/spelling between SP and metadata; metadata resolver scoped to a different entity set.","solutions":["Confirm the SP entityID exists in the metadata loaded by the IdP metadata resolver and refresh metadata if stale","Check that the policy is only applied within an actual SAML request context that carries the entity id","Log/inspect SamlIdPSAttributeReleasePolicyUtils.getEntityIdFromRequest(context) to see what id is being resolved","Fix the service definition's entityId to exactly match the metadata EntityDescriptor entityID"],"exampleFix":"// before: empty release with no diagnosis\nreturn new HashMap<>();\n// after: guard/fail fast when metadata is missing\nif (facade.isEmpty()) {\n    throw new SamlException(\"No metadata for entity \" + entityId);\n}","handlingStrategy":"validation","validationCode":"// verify entity metadata before evaluating the policy\nval facade = SamlIdPSAttributeReleasePolicyUtils\n    .determineServiceProviderMetadataFacade(context, entityId);\nif (facade.isEmpty()) throw new IllegalStateException('No metadata for ' + entityId);","typeGuard":"function metadataExists(ctx, entityId) { return entityId != null && !entityId.isBlank() && findMetadata(ctx, entityId).isPresent(); }","tryCatchPattern":"val attrs = policy.getAttributes(...);\nif (attrs.isEmpty()) { /* audit logs: was metadata missing for the entity? */ }","preventionTips":["Ensure every SP entityID is present in loaded IdP metadata","Apply SAML release policies only within SAML request contexts","Match entityID strings exactly (case/whitespace) between SP config and metadata"],"tags":["saml","idp","attributes","metadata","entity-not-found"],"backgroundTag":"entity-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}