{"record":{"id":"57a466c823c4df8b","repo":"apereo/cas","slug":"federation-role-role-is-not-supported-fo","errorCode":null,"errorMessage":"Federation role [\" + role + \"] is not supported for Trust Anchor/Intermediate","messagePattern":"Federation role \\[\" \\+ role \\+ \"\\] is not supported for Trust Anchor/Intermediate","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java","lineNumber":94,"sourceCode":"            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"OpenID provider requires authority hint(s)\");\n            }\n\n            val json = JSONValue.parse(settings.toJson());\n            metadata.put(EntityType.OPENID_PROVIDER.getValue(), json);\n\n        } else if (role == OidcFederationRole.INTERMEDIATE) {\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Intermediate requires authority hint(s)\");\n            }\n\n        } else if (role == OidcFederationRole.TRUST_ANCHOR) {\n            if (!authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Trust anchor requires no authority hints\");\n            }\n\n        } else {\n            throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for Trust Anchor/Intermediate\");\n        }\n\n        val federationMetadata = buildMetadata(issuer);\n        metadata.put(EntityType.FEDERATION_ENTITY.getValue(), federationMetadata.toJSONObject());\n\n        return buildEntityStatement(issuer, issuer, metadata, null, authorityHints);\n    }\n}\n","sourceCodeStart":76,"sourceCodeEnd":103,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java#L76-L103","documentation":"Thrown by getWellKnownDiscoveryConfiguration in the OIDC federation well-known endpoint controller when the requested federation entity role is neither TRUST_ANCHOR nor TRUST_INTERMEDIATE. Only these two roles can publish a federation_entity metadata document; other OidcFederationRole values (e.g. relying party / OP roles) are not valid for this endpoint. The controller rejects the request early rather than building an invalid entity statement.","triggerScenarios":"Calling GET on the well-known federation endpoint with a role parameter that maps to an OidcFederationRole value other than OidcFederationRole.TRUST_ANCHOR or the intermediate role; a client passing a misnamed or unsupported role string that resolves to an unexpected enum member.","commonSituations":"Developers hand-crafting federation discovery URLs copy role names from other OIDC parts of CAS (e.g. 'provider' or 'rp') that are not federation-entity roles; typos in documentation; testing the endpoint against a role added in a newer CAS version but requesting an invalid one.","solutions":["Change the request to use role=trust_anchor or the intermediate role value supported by the endpoint.","Inspect OidcFederationRole to see the exact set of roles accepted for federation_entity metadata.","If you need metadata for another role type, use the corresponding OIDC endpoint (e.g. discovery for the provider) instead of the federation well-known endpoint.","Upgrade CAS if you believe the role you passed should be supported but is not present in OidcFederationRole."],"exampleFix":"// before\ncurl 'https://cas.example.org/oidc/.well-known/openid-federation?role=provider'\n// after\ncurl 'https://cas.example.org/oidc/.well-known/openid-federation?role=trust_anchor'","handlingStrategy":"validation","validationCode":"Set<String> supported = Set.of(\"trust_anchor\", \"trust_intermediate\");\nif (!supported.contains(requestedRole)) {\n    throw new IllegalArgumentException(\"Unsupported federation role: \" + requestedRole);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Consult OidcFederationRole for the exact accepted role values before calling the endpoint.","Use an enum-typed client parameter instead of free-form strings."],"tags":["oidc","federation","invalid-role","illegal-argument"],"backgroundTag":"invalid-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}