{"record":{"id":"7427be341f6e1931","repo":"apereo/cas","slug":"no-signature-or-configuration-was-provided-to-vali","errorCode":null,"errorMessage":"No signature or configuration was provided to validate signatures","messagePattern":"No signature or configuration was provided to validate signatures","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java","lineNumber":259,"sourceCode":"        return reqToken.getSecurityTokens().getFirst();\n    }\n\n    /**\n     * validateSignature checks to see if the signature on an assertion is valid.\n     *\n     * @param resultPair a provided assertion\n     * @return true if the assertion's signature is valid, otherwise false\n     */\n    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {\n        if (resultPair == null) {\n            LOGGER.warn(\"No assertion or its configuration was provided to validate signatures\");\n            return false;\n        }\n        val configuration = resultPair.getValue();\n        val assertion = resultPair.getKey();\n\n        if (assertion == null || configuration == null) {\n            LOGGER.warn(\"No signature or configuration was provided to validate signatures\");\n            return false;\n        }\n        val signature = assertion.getSignature();\n        if (signature == null) {\n            LOGGER.warn(\"No signature is attached to the assertion to validate\");\n            return false;\n        }\n        try {\n            LOGGER.debug(\"Validating the signature...\");\n            val validator = new SAMLSignatureProfileValidator();\n            validator.validate(signature);\n\n            val criteriaSet = new CriteriaSet();\n            criteriaSet.add(new UsageCriterion(UsageType.SIGNING));\n            criteriaSet.add(new EntityRoleCriterion(IDPSSODescriptor.DEFAULT_ELEMENT_NAME));\n            criteriaSet.add(new ProtocolCriterion(SAMLConstants.SAML20P_NS));\n            criteriaSet.add(new EntityIdCriterion(configuration.getIdentityProviderIdentifier()));\n            val engine = buildSignatureTrustEngine(configuration);","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java#L241-L277","documentation":"In validateSignature, after confirming the pair exists, either the assertion or its WsFederationConfiguration being null also yields this warning and a false return. Signature validation requires both the assertion and configuration (trusted issuer/cert settings).","triggerScenarios":"resultPair constructed with one side null — e.g. Pair(null, config) or Pair(assertion, null) — typically from a partially failed parse or incorrectly built configuration object.","commonSituations":"WsFederationConfiguration bean not populated (missing properties); assertion unmarshalling failed silently producing null; code refactors swapping pair order.","solutions":["Ensure the WsFederationConfiguration is fully built (signing certificate/keystore, issuer) before validation.","Verify the assertion extraction step returns a non-null Assertion for valid wresult payloads.","Log/inspect the pair construction site to find which element is null and fix its producer."],"exampleFix":"// before\nval pair = Pair.of(maybeAssertion, null);\n// after\nval pair = Pair.of(assertion, wsFederationConfiguration);","handlingStrategy":"type-guard","validationCode":"if (pair == null || pair.getKey() == null || pair.getValue() == null) {\n    throw new IllegalStateException(\"validateSignature requires non-null assertion and configuration\");\n}","typeGuard":"boolean isValidateInput(Pair<Assertion, WsFederationConfiguration> p) {\n    return p != null && p.getKey() != null && p.getValue() != null;\n}","tryCatchPattern":null,"preventionTips":["Build WsFederationConfiguration via its configuration class so required fields are set.","Unit-test the pair construction path."],"tags":["ws-federation","saml","signature","null-input"],"backgroundTag":"null-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}