{"record":{"id":"5573b8d0fa04185f","repo":"apereo/cas","slug":"federation-role-s-is-not-supported-for-openid-p","errorCode":null,"errorMessage":"Federation role [%s] is not supported for OpenID Provider","messagePattern":"Federation role \\[(.+?)\\] is not supported for OpenID Provider","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java","lineNumber":72,"sourceCode":"        description = \"Handles requests for well-known OIDC discovery federation configuration\")\n    public ResponseEntity getWellKnownDiscoveryConfiguration(\n        final HttpServletRequest request, final HttpServletResponse response) throws Exception {\n\n        LOGGER.info(\"Generating federation entity statement\");\n\n        val error = retrieveInvalidIssuerError(request, response, OidcConstants.FETCH_FEDERATION_URL);\n        if (error != null) {\n            return error;\n        }\n\n        val role = oidcProperties.getFederation().getRole();\n        val settings = serverDiscoverySettings.getIfAvailable();\n        var issuer = oidcProperties.getCore().getIssuer();\n        val metadata = new JSONObject();\n        val authorityHints = oidcProperties.getFederation().getAuthorityHints().stream().map(EntityID::new).toList();\n        if (settings != null) {\n            if (role != OidcFederationRole.OPENID_PROVIDER) {\n                throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for OpenID Provider\");\n            }\n            issuer = settings.getIssuer();\n\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"OpenID provider requires authority hint(s)\");\n            }\n\n            val json = JSONValue.parse(settings.toJson());\n            metadata.put(EntityType.OPENID_PROVIDER.getValue(), json);\n\n        } else if (role == OidcFederationRole.INTERMEDIATE) {\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Intermediate requires authority hint(s)\");\n            }\n\n        } else if (role == OidcFederationRole.TRUST_ANCHOR) {\n            if (!authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Trust anchor requires no authority hints\");","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java#L54-L90","documentation":"The .well-known/openid-federation discovery controller serves OP metadata only when the deployment role is OPENID_PROVIDER. If server discovery settings are present but role != OPENID_PROVIDER, it throws this IllegalArgumentException naming the configured role.","triggerScenarios":"CAS started with OP server discovery settings available (OP metadata bean present) while cas.oidc.federation.role is TRUST_ANCHOR or INTERMEDIATE, and the well-known federation endpoint is hit.","commonSituations":"Federating OP deployment forgot to set role=OPENID_PROVIDER; role later changed to intermediate/trust-anchor but OP metadata configuration left in place; conflicting federation/OP settings in the same deployment.","solutions":["Set cas.oidc.federation.role=OPENID_PROVIDER when serving OP discovery metadata","Remove/adjust the OP server discovery settings if this deployment should be TRUST_ANCHOR or INTERMEDIATE only","Split OP and federation-entity roles into separate deployments"],"exampleFix":"// before\ncas.oidc.federation.role=TRUST_ANCHOR\n# ...OP discovery settings still configured...\n// after\ncas.oidc.federation.role=OPENID_PROVIDER","handlingStrategy":"validation","validationCode":"val role = oidcProperties.getFederation().getRole();\nif (serverDiscoverySettingsPresent && role != OidcFederationRole.OPENID_PROVIDER) {\n    throw new IllegalStateException(\"OP discovery settings present but role is \" + role);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep OP and federation-entity roles in separate deployments","Audit role vs configured metadata beans at startup","Document role choices in deployment configs"],"tags":["configuration","oidc-federation","invalid-role"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}