{"record":{"id":"6bf71c4eae26d320","repo":"apereo/cas","slug":"groovy-script-does-not-exist-or-cannot-be-loa","errorCode":null,"errorMessage":"Groovy script [{}] does not exist or cannot be loaded","messagePattern":"Groovy script \\[(.+?)\\] does not exist or cannot be loaded","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/GroovySamlRegisteredServiceAttributeReleasePolicy.java","lineNumber":57,"sourceCode":"    protected Map<String, List<Object>> getAttributesForSamlRegisteredService(\n        final Map<String, List<Object>> attributes,\n        final SamlRegisteredServiceCachingMetadataResolver resolver,\n        final SamlRegisteredServiceMetadataAdaptor facade,\n        final EntityDescriptor entityDescriptor,\n        final RegisteredServiceAttributeReleasePolicyContext context) {\n\n        return ApplicationContextProvider.getScriptResourceCacheManager()\n            .map(cacheMgr -> {\n                val groovyResource = SpringExpressionLanguageValueResolver.getInstance().resolve(this.groovyScript);\n                val script = cacheMgr.resolveScriptableResource(groovyResource, groovyResource);\n                return Optional.ofNullable(script)\n                    .map(Unchecked.function(sc -> {\n                        val args = new Object[]{attributes, context.getRegisteredService(), resolver,\n                            facade, entityDescriptor, context.getApplicationContext(), LOGGER};\n                        return (Map<String, List<Object>>) script.execute(args, Map.class, true);\n                    }))\n                    .orElseGet(() -> {\n                        LOGGER.warn(\"Groovy script [{}] does not exist or cannot be loaded\", groovyScript);\n                        return new HashMap<>();\n                    });\n            })\n            .orElseThrow(() -> new RuntimeException(\"No groovy script cache manager is available to execute attribute mappings\"));\n    }\n}\n","sourceCodeStart":39,"sourceCodeEnd":64,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/services/GroovySamlRegisteredServiceAttributeReleasePolicy.java#L39-L64","documentation":"GroovySamlRegisteredServiceAttributeReleasePolicy.getAttributesForSamlRegisteredService() executes the configured Groovy script from the script cache to compute released attributes. If the script resource cannot be located or loaded (Optional empty from the cache lookup), it logs this warning and returns an empty attribute map; if no script cache manager exists at all it throws a RuntimeException. Either way no attributes are released from the script.","triggerScenarios":"A service's attribute release policy references a Groovy script path that does not exist, is misfiled (relative vs classpath/file: URL), or fails to compile/load; or the policy runs without a Groovy script cache manager bean configured.","commonSituations":"Typo in file:groovy path in the service definition JSON; script not deployed to the CAS server filesystem or classpath; file permissions denying read; moving from inline Groovy to external script after an upgrade; cache manager not initialized in a custom wiring.","solutions":["Verify the script path/URL in the service definition resolves from the CAS server (test with file/classpath resource access) and is readable by the CAS user","Check the script compiles by executing it standalone or watching startup logs for Groovy compilation errors","Ensure the Groovy script cache manager is available (correct CAS module/wiring) so the policy does not throw","Return a valid Map<String,List<Object>> from the script; an empty map is the safe no-attributes contract"],"exampleFix":"// before: wrong path in service policy\n\"groovyScript\" : \"file:/etc/cas/scripts/attr-release.groovy.bak\"\n// after\n\"groovyScript\" : \"file:/etc/cas/scripts/attr-release.groovy\"","handlingStrategy":"validation","validationCode":"// check the script resource before configuring the policy\nval f = new File('/etc/cas/scripts/attr-release.groovy');\nif (!f.isFile() || !f.canRead()) throw new FileNotFoundException(f.getPath());","typeGuard":"function scriptLoaded(cache, path) { return cache != null && cache.resolveScriptResource(path).isPresent(); }","tryCatchPattern":"try { attrs = policy.getAttributesInternal(...); }\ncatch (RuntimeException e) { log.error('Groovy policy failed: no script cache', e); attrs = Map.of(); }","preventionTips":["Validate script paths after every deploy or service-import","Give the CAS process read permission on script directories","Test-compile Groovy scripts in CI before shipping them","Return Map<String,List<Object>> from scripts to match the policy contract"],"tags":["saml","groovy","attributes","script-not-found","release-policy"],"backgroundTag":"file-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}