{"record":{"id":"51d11b4672dae5fd","repo":"apereo/cas","slug":"cannot-find-service-provider-metadata-entity-linke","errorCode":null,"errorMessage":"Cannot find service provider metadata entity linked to [{}]","messagePattern":"Cannot find service provider metadata entity linked to \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutRedirectionStrategy.java","lineNumber":83,"sourceCode":"                && samlRegisteredService.isLogoutResponseEnabled()\n                && sloRequest != null\n                && !async;\n        }\n        return false;\n    }\n\n    @Override\n    public LogoutRedirectionResponse handle(final HttpServletRequest request, final HttpServletResponse response) throws Exception {\n        val samlRegisteredService = (SamlRegisteredService) WebUtils.getRegisteredService(request);\n        val samlLogoutRequest = getLogoutRequest(request).orElseThrow();\n\n        val logoutRequestIssuer = SamlIdPUtils.getIssuerFromSamlObject(samlLogoutRequest);\n        val adapterResult = SamlRegisteredServiceMetadataAdaptor.get(\n            configurationContext.getSamlRegisteredServiceCachingMetadataResolver(),\n            samlRegisteredService, logoutRequestIssuer);\n\n        if (adapterResult.isEmpty()) {\n            LOGGER.warn(\"Cannot find service provider metadata entity linked to [{}]\", logoutRequestIssuer);\n            return null;\n        }\n        \n        val adaptor = adapterResult.get();\n        val binding = determineLogoutResponseBindingType(adaptor, samlRegisteredService);\n        LOGGER.debug(\"Logout response binding type is determined as [{}]\", binding);\n\n        if (SAMLConstants.SAML2_POST_BINDING_URI.equals(binding)) {\n            return handleSingleLogoutForPostBinding(samlLogoutRequest, samlRegisteredService, adaptor, request, response);\n        }\n        return handleSingleLogoutForRedirectBinding(samlLogoutRequest, samlRegisteredService, adaptor, request, response);\n    }\n\n    protected String determineLogoutResponseBindingType(final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                        final SamlRegisteredService samlRegisteredService) {\n\n        val logout = configurationContext.getCasProperties().getAuthn().getSamlIdp().getLogout();\n        var binding = logout.getLogoutResponseBinding();","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutRedirectionStrategy.java#L65-L101","documentation":"During SAML single logout, CAS resolves the issuing SP's SAML metadata to determine how to respond. If the metadata resolver cache has no entity descriptor matching the logout request's issuer, this warning is logged and the strategy returns null, aborting the logout response.","triggerScenarios":"handle() receives a SAML LogoutRequest whose issuer entityID is not present in the metadata of the matched SamlRegisteredService — e.g. wrong entity id configured in the service definition, metadata file/URL missing that entity, metadata expired/refreshed out, or federation filter excluding it.","commonSituations":"Metadata aggregation errors at startup; SP changed its entityID; service regex matched metadata aggregate that lacks the specific entity; cached stale metadata in the resolver cache; typo in service metadata location.","solutions":["Verify the entityID in the incoming LogoutRequest exactly matches an entity in the configured metadata for the service.","Refresh the metadata: check the metadata URL is reachable and valid, or update the local metadata resource.","Increase metadata cache expiry or clear the metadata resolver cache so stale/absent entries are refetched.","Use the /idp/metadata or debug logging (SamlRegisteredServiceMetadataAdaptor) to list available entity ids.","If the SP no longer participates in SLO, treat as expected and ensure back-channel logout silently ignores null."],"exampleFix":"// before\ncas.authn.saml-idp.metadata.location=file:/etc/cas/saml/sp-metadata.xml\n// after (metadata file updated to include the SP entity)\ncas.authn.saml-idp.metadata.location=file:/etc/cas/saml/sp-metadata-updated.xml","handlingStrategy":"fallback","validationCode":"var adaptor = SamlRegisteredServiceMetadataAdaptor.get(resolver, service, issuer);\nif (adaptor.isEmpty()) {\n    LOGGER.warn(\"No metadata for issuer {} — skipping SLO response\", issuer);\n    return;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep SP metadata current and verified against the SP's real entityID.","Schedule metadata refresh shorter than the source's validity interval.","Test SLO after any metadata or service definition change."],"tags":["saml","slo","metadata"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}