{"record":{"id":"575de50f9f636ee9","repo":"apereo/cas","slug":"cannot-find-slo-service-in-metadata-for-entity-id","errorCode":null,"errorMessage":"Cannot find SLO service in metadata for entity id [{}]","messagePattern":"Cannot find SLO service in metadata for entity id \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceLogoutUrlBuilder.java","lineNumber":112,"sourceCode":"                return attribute.getEntityIdFrom(samlRegisteredServiceCachingMetadataResolver, attributeValue);\n            })\n            .orElseGet(singleLogoutService::getId);\n        LOGGER.trace(\"Located entity id [{}]\", entityID);\n\n        val adaptorRes = SamlRegisteredServiceMetadataAdaptor.get(\n            samlRegisteredServiceCachingMetadataResolver, samlRegisteredService, entityID);\n        if (adaptorRes.isEmpty()) {\n            LOGGER.warn(\"Cannot find metadata linked to [{}]\", entityID);\n            return null;\n        }\n        val adaptor = adaptorRes.get();\n        for (val binding : this.logoutRequestBindings) {\n            var sloService = adaptor.getSingleLogoutService(binding);\n            if (sloService != null) {\n                return finalizeSingleLogoutUrl(sloService, samlRegisteredService);\n            }\n        }\n        LOGGER.warn(\"Cannot find SLO service in metadata for entity id [{}]\", entityID);\n        return null;\n    }\n\n    private static @Nullable SingleLogoutUrl finalizeSingleLogoutUrl(final SingleLogoutService sloService, final SamlRegisteredService service) {\n        val location = StringUtils.isBlank(sloService.getResponseLocation())\n            ? sloService.getLocation()\n            : sloService.getResponseLocation();\n        if (StringUtils.isNotBlank(location)) {\n            val url = new SingleLogoutUrl(location, service.getLogoutType());\n            url.getProperties().put(PROPERTY_NAME_SINGLE_LOGOUT_BINDING, sloService.getBinding());\n            return url;\n        }\n        return null;\n    }\n}\n","sourceCodeStart":94,"sourceCodeEnd":128,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/slo/SamlIdPSingleLogoutServiceLogoutUrlBuilder.java#L94-L128","documentation":"The SP's EntityDescriptor was found in metadata, but it declares no SingleLogoutService endpoint for any of the bindings CAS supports for logout. CAS logs this warning and returns null, so no logout request is sent to that SP.","triggerScenarios":"buildLogoutUrl iterates logoutRequestBindings and adaptor.getSingleLogoutService(binding) returns null for every binding — the SP metadata has no <md:SingleLogoutService> elements, or only bindings CAS isn't configured to use.","commonSituations":"SP metadata exports SSO but not SLO; metadata lists SingleLogoutService with a binding (e.g. SOAP) not in cas.authn.saml-idp.logout bindings; trimmed/minimal SP metadata.","solutions":["Regenerate/repair SP metadata to include SingleLogoutService endpoints (HTTP-Redirect/POST).","Add the binding used by the SP to cas.authn.saml-idp.logout.single-logout bindings list.","Verify with the SP vendor whether SLO is supported at all; if not, accept null and skip back-channel logout.","Compare the bindings in metadata against CAS's logoutRequestBindings via debug logs."],"exampleFix":"// before\ncas.authn.saml-idp.logout.single-logout=[\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"]\n// after\ncas.authn.saml-idp.logout.single-logout=[\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\",\"urn:oasis:names:tc:SAML:2.0:bindings:SOAP\"]","handlingStrategy":"fallback","validationCode":"var hasSlo = Arrays.stream(logoutRequestBindings)\n    .anyMatch(b -> adaptor.getSingleLogoutService(b) != null);\nif (!hasSlo) {\n    LOGGER.info(\"SP {} has no SLO endpoint; skipping back-channel logout\", entityID);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ensure SP metadata includes SingleLogoutService elements if SLO is required.","Match CAS configured logout bindings with the SP's advertised bindings.","Document SPs that do not support SLO and accept the null outcome."],"tags":["saml","metadata","slo"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}