{"record":{"id":"4d3dc9dcb3c9689d","repo":"apereo/cas","slug":"could-not-find-value-for-mapped-attribute-tha","errorCode":null,"errorMessage":"Could not find value for mapped attribute [{}] that is based off of [{}] in the allowed attributes list. Ensure the original attribute [{}] is retrieved and contains at least a single value. Attribute [{}] will and can not be released without the presence of a value.","messagePattern":"Could not find value for mapped attribute \\[(.+?)\\] that is based off of \\[(.+?)\\] in the allowed attributes list\\. Ensure the original attribute \\[(.+?)\\] is retrieved and contains at least a single value\\. Attribute \\[(.+?)\\] will and can not be released without the presence of a value\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-idp-api/src/main/java/org/apereo/cas/ws/idp/services/WSFederationClaimsReleasePolicy.java","lineNumber":79,"sourceCode":"                    LOGGER.trace(\"Evaluating claim [{}] mapped to attribute value [{}]\", claim.getUri(), attributeValue);\n                    mapSingleAttributeDefinition(claim.getUri(), entry.getValue(),\n                        attributeValue, resolvedAttributes, attributesToRelease);\n                }\n            });\n        return attributesToRelease;\n    }\n\n    private static void mapSimpleSingleAttributeDefinition(final String attributeName,\n                                                           final String mappedAttributeName,\n                                                           final List<Object> attributeValue,\n                                                           final Map<String, List<Object>> attributesToRelease) {\n        if (attributeValue != null) {\n            LOGGER.debug(\"Found attribute [{}] in the list of allowed attributes, mapped to the name [{}]\",\n                attributeName, mappedAttributeName);\n            val values = CollectionUtils.toCollection(attributeValue, ArrayList.class);\n            attributesToRelease.put(attributeName, values);\n        } else {\n            LOGGER.warn(\"Could not find value for mapped attribute [{}] that is based off of [{}] in the allowed attributes list. \"\n                    + \"Ensure the original attribute [{}] is retrieved and contains at least a single value. Attribute [{}] \"\n                    + \"will and can not be released without the presence of a value.\", mappedAttributeName, attributeName,\n                attributeName, mappedAttributeName);\n        }\n    }\n\n    private static void mapSingleAttributeDefinition(final String attributeName,\n                                                     final String mappedAttributeName,\n                                                     final List<Object> attributeValue,\n                                                     final Map<String, List<Object>> resolvedAttributes,\n                                                     final Map<String, List<Object>> attributesToRelease) {\n        val scriptFactoryInstance = ExecutableCompiledScriptFactory.findExecutableCompiledScriptFactory();\n\n        if (scriptFactoryInstance.isPresent()) {\n            val scriptFactory = scriptFactoryInstance.get();\n            \n            if (scriptFactory.isInlineScript(mappedAttributeName)) {\n                val inlineGroovy = scriptFactory.getInlineScript(mappedAttributeName).orElseThrow();","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-idp-api/src/main/java/org/apereo/cas/ws/idp/services/WSFederationClaimsReleasePolicy.java#L61-L97","documentation":"WS-Federation claims release policy maps requested claim URIs (e.g. emailaddress) to CAS attribute names; when the mapped source attribute is absent or has no value in the principal's attribute bundle, the claim cannot be released and this warning is logged. Release proceeds without that attribute.","triggerScenarios":"mapSingleAttributeDefinition -> mapSimpleSingleAttributeDefinition is called during attribute release and allowedAttributes.get(mappedAttributeName) returns null because the principal lacks the attribute the claim maps to.","commonSituations":"LDAP/attribute repository not returning the mapped attribute (no mail, givenName, etc.); claim-to-attribute mapping names an attribute with different casing; user record missing the value; attribute filtered out by an earlier release/filter policy.","solutions":["Ensure the authentication/attribute source actually retrieves the mapped attribute (e.g. add it to LDAP allowed attributes)","Fix the mapping in the WS-Federation service's claims mapping so it points at an attribute the principal really has","Check attribute casing/naming against what the principal carries and align","If the claim is genuinely optional, ignore the warning; it only means the claim is skipped"],"exampleFix":"// before: mapping claims to 'mail' but only 'email' is fetched\n\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" -> \"mail\"\n// after: align with retrieved attribute name\n\"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress\" -> \"email\"","handlingStrategy":"validation","validationCode":"var missing = claimsMap.values().stream().filter(a -> principal.getAttributes().get(a) == null).toList();\nif (!missing.isEmpty()) LOGGER.warn(\"Attributes missing for claims: {}\", missing);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Audit claim-to-attribute mappings against the attribute repository's fetched attribute list","Test release policy with a representative test user","Keep attribute names consistently cased across source and mappings"],"tags":["ws-federation","attribute-release","claims-mapping"],"backgroundTag":"empty-required-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}