{"record":{"id":"8ae6d35b1d61d8c3","repo":"apereo/cas","slug":"no-providerid-parameter-given-in-unsolicited-sso-a","errorCode":null,"errorMessage":"No providerId parameter given in unsolicited SSO authentication request.","messagePattern":"No providerId parameter given in unsolicited SSO authentication request\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java","lineNumber":171,"sourceCode":"            LOGGER.info(\"Resolving service provider assertion consumer service URL for [{}] and binding [{}]\",\n                providerId, SAMLConstants.SAML2_POST_BINDING_URI);\n            val acs = facade.getAssertionConsumerService(SAMLConstants.SAML2_POST_BINDING_URI);\n            shire = Optional.ofNullable(acs)\n                .map(service -> StringUtils.isBlank(service.getResponseLocation())\n                    ? service.getLocation()\n                    : service.getResponseLocation()).orElse(null);\n        }\n        if (StringUtils.isBlank(shire)) {\n            LOGGER.warn(\"Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: [{}]\", providerId);\n            throw new MessageDecodingException(\"Unable to resolve SP ACS URL for AuthnRequest construction\");\n        }\n        return shire;\n    }\n\n    protected String extractProviderId(final HttpServletRequest request) throws MessageDecodingException {\n        val providerId = request.getParameter(SamlIdPConstants.PROVIDER_ID);\n        if (StringUtils.isBlank(providerId)) {\n            LOGGER.warn(\"No providerId parameter given in unsolicited SSO authentication request.\");\n            throw new MessageDecodingException(\"Missing providerId\");\n        }\n        return providerId;\n    }\n}\n","sourceCodeStart":153,"sourceCodeEnd":177,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java#L153-L177","documentation":"The IdP-initiated (unsolicited) SSO endpoint was invoked without the required providerId request parameter, which identifies the SP entityID to authenticate against. extractProviderId treats a blank providerId as a malformed request and throws MessageDecodingException. Without it CAS cannot select a service or metadata.","triggerScenarios":"A GET/POST to the unsolicited SSO profile endpoint (e.g. /idp/profile/SAML2/Unsolicited/SSO) missing the providerId query/form parameter, or the parameter present but empty/whitespace.","commonSituations":"Bookmark/portal link constructed incorrectly; reverse proxy or gateway stripping query parameters; SP integration guide followed with wrong parameter name (e.g. 'providerId' misspelled or case-incorrect); deep link regenerated by front-end code dropping params.","solutions":["Append the providerId parameter with the SP's entityID to the unsolicited SSO URL (e.g. ?providerId=https%3A%2F%2Fsp.example.com%2Fshib).","URL-encode the entityID; special characters (://, spaces) in unencoded URLs can cause the parameter to be dropped by proxies.","Check any intermediary (proxy, WAF, gateway) is not stripping the query string; compare the request seen by CAS via access logs.","Confirm you are using the documented parameter name for your CAS version (SamlIdPConstants.PROVIDER_ID = 'providerId')."],"exampleFix":"// before: missing providerId\nGET /cas/idp/profile/SAML2/Unsolicited/SSO?shire=https://sp.example.com/Shibboleth.sso/SAML2/POST\n// after: include providerId (URL-encoded entityID)\nGET /cas/idp/profile/SAML2/Unsolicited/SSO?providerId=https%3A%2F%2Fsp.example.com%2Fshib&shire=https://sp.example.com/Shibboleth.sso/SAML2/POST","handlingStrategy":"validation","validationCode":"// Caller-side guard before invoking the unsolicited SSO endpoint\nString providerId = request.getParameter(\"providerId\");\nif (providerId == null || providerId.isBlank()) {\n    throw new IllegalArgumentException(\"providerId is required for unsolicited SSO\");\n}","typeGuard":"boolean hasProviderId(HttpServletRequest req) { return StringUtils.isNotBlank(req.getParameter(SamlIdPConstants.PROVIDER_ID)); }","tryCatchPattern":"try {\n    providerId = extractProviderId(request);\n} catch (MessageDecodingException e) {\n    LOGGER.error(\"Unsolicited SSO called without providerId from {}\", request.getRemoteAddr(), e);\n    // 400 with usage hint: append ?providerId=<url-encoded entityID>\n}","preventionTips":["Generate unsolicited SSO links via a template that always includes providerId.","URL-encode the entityID when building links.","Verify proxies preserve query strings for the IdP endpoints."],"tags":["saml","missing-parameter","unsolicited-sso","cas"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}