{"record":{"id":"83772299ae244a68","repo":"apereo/cas","slug":"no-principal-could-be-identified-in-the-claim-para","errorCode":null,"errorMessage":"No principal could be identified in the claim parameters request","messagePattern":"No principal could be identified in the claim parameters request","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java","lineNumber":47,"sourceCode":"    private final String handlerRealm;\n\n    private final String issuer;\n\n    @Override\n    public List<String> getSupportedClaimTypes() {\n        return WSFederationClaims.ALL_CLAIMS.stream()\n            .map(WSFederationClaims::getUri)\n            .collect(Collectors.toList());\n    }\n\n    @Override\n    public ProcessedClaimCollection retrieveClaimValues(final ClaimCollection claims, final ClaimsParameters parameters) {\n        if (parameters.getRealm() == null || !parameters.getRealm().equalsIgnoreCase(this.handlerRealm)) {\n            LOGGER.warn(\"Realm [{}] doesn't match with configured realm [{}]\", parameters.getRealm(), this.handlerRealm);\n            return new ProcessedClaimCollection();\n        }\n        if (parameters.getPrincipal() == null) {\n            LOGGER.warn(\"No principal could be identified in the claim parameters request\");\n            return new ProcessedClaimCollection();\n        }\n        if (claims == null || claims.isEmpty()) {\n            LOGGER.warn(\"No claims are available to process\");\n            return new ProcessedClaimCollection();\n        }\n        val claimCollection = new ProcessedClaimCollection();\n        claims.stream().map(c -> createProcessedClaim(c, parameters)).forEach(claimCollection::add);\n        return claimCollection;\n    }\n\n    /**\n     * Create processed claim processed claim.\n     *\n     * @param requestClaim the request claim\n     * @param parameters   the parameters\n     * @return the processed claim\n     */","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java#L29-L65","documentation":"retrieveClaimValues requires an authenticated principal in ClaimsParameters. When parameters.getPrincipal() is null it logs this warning and returns an empty claim collection, because attribute/claim resolution is identity-driven and cannot proceed without a subject.","triggerScenarios":"ClaimsParameters built without setPrincipal(...) before retrieveClaimValues is invoked — typically when the STS token provider failed to resolve an authenticated user for the request (anonymous validation, missing credential, or custom token provider that skips principal setup).","commonSituations":"Custom SecurityTokenServiceProvider/TokenProvider that constructs ClaimsParameters manually and forgets the principal; anonymous or bearer-token flows that do not authenticate the caller; earlier validation failure swallowed upstream.","solutions":["Ensure the token provider/validator populates ClaimsParameters.setPrincipal(Principal) with the authenticated user before claims retrieval.","Check upstream validation steps: if the credential failed validation the principal never gets attached; fix the root authentication failure.","For service-actor scenarios, supply a synthetic principal if your flow legitimately has no user identity."],"exampleFix":"// before\nval params = new ClaimsParameters<>();\nparams.setRealm(realm);\n// after\nval params = new ClaimsParameters<>();\nparams.setRealm(realm);\nparams.setPrincipal(userPrincipal); // authenticated subject","handlingStrategy":"type-guard","validationCode":"if (parameters.getPrincipal() == null) {\n    throw new IllegalStateException(\"ClaimsParameters has no principal; authentication must complete first\");\n}","typeGuard":"boolean hasPrincipal(ClaimsParameters<?> p) {\n    return p.getPrincipal() != null && StringUtils.isNotBlank(p.getPrincipal().getName());\n}","tryCatchPattern":null,"preventionTips":["Always set principal on ClaimsParameters immediately after successful credential validation.","In custom token providers, assert principal presence before calling retrieveClaimValues."],"tags":["sts","claims","missing-principal","authentication"],"backgroundTag":"missing-credentials","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}