{"record":{"id":"9011f8b5938fa5fc","repo":"apereo/cas","slug":"realm-doesn-t-match-with-configured-realm","errorCode":null,"errorMessage":"Realm [{}] doesn't match with configured realm [{}]","messagePattern":"Realm \\[(.+?)\\] doesn't match with configured realm \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java","lineNumber":43,"sourceCode":"@Getter\n@RequiredArgsConstructor\npublic class WrappingSecurityTokenServiceClaimsHandler implements ClaimsHandler, RealmSupport {\n\n    private final String handlerRealm;\n\n    private final String issuer;\n\n    @Override\n    public List<String> getSupportedClaimTypes() {\n        return WSFederationClaims.ALL_CLAIMS.stream()\n            .map(WSFederationClaims::getUri)\n            .collect(Collectors.toList());\n    }\n\n    @Override\n    public ProcessedClaimCollection retrieveClaimValues(final ClaimCollection claims, final ClaimsParameters parameters) {\n        if (parameters.getRealm() == null || !parameters.getRealm().equalsIgnoreCase(this.handlerRealm)) {\n            LOGGER.warn(\"Realm [{}] doesn't match with configured realm [{}]\", parameters.getRealm(), this.handlerRealm);\n            return new ProcessedClaimCollection();\n        }\n        if (parameters.getPrincipal() == null) {\n            LOGGER.warn(\"No principal could be identified in the claim parameters request\");\n            return new ProcessedClaimCollection();\n        }\n        if (claims == null || claims.isEmpty()) {\n            LOGGER.warn(\"No claims are available to process\");\n            return new ProcessedClaimCollection();\n        }\n        val claimCollection = new ProcessedClaimCollection();\n        claims.stream().map(c -> createProcessedClaim(c, parameters)).forEach(claimCollection::add);\n        return claimCollection;\n    }\n\n    /**\n     * Create processed claim processed claim.\n     *","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/claims/WrappingSecurityTokenServiceClaimsHandler.java#L25-L61","documentation":"WrappingSecurityTokenServiceClaimsHandler.retrieveClaimValues only issues claims when the realm in the incoming ClaimsParameters matches the handler's configured realm (case-insensitive). On mismatch (or a null realm) it logs this warning and returns an empty ProcessedClaimCollection instead of claims. This is a guard so one handler only serves its own realm in a multi-realm STS deployment.","triggerScenarios":"The STS issues a token for a realm whose name differs from the realm string this claims handler was configured with (e.g. handlerRealm set to 'A' but the token request parses/defaults to realm 'B', or getRealm() returns null because no realm parser matched).","commonSituations":"Misconfigured cas.authn.ws-sts realm maps vs the handler's realm property; missing or misfiring RealmParser so parameters.getRealm() is null; renamed realms after a migration; case/whitespace differences if code paths bypass equalsIgnoreCase.","solutions":["Set the claims handler's realm to exactly match the realm string produced by the STS realm parser for the request (compare log values; they are printed).","Configure the realm parser (e.g. UriRealmParser realmMap) so the requested URI maps to the expected realm instead of null/another name.","If the handler should serve all realms, register the handler without a realm restriction or add one handler instance per realm.","Use the returned empty claim collection as a signal: enable debug logging to trace which realm string each side computes."],"exampleFix":"// before\nhandler.setHandlerRealm(\"REALM_A\"); // requests arrive for realm \"B\"\n// after\nhandler.setHandlerRealm(\"REALM_B\"); // matches parameters.getRealm()","handlingStrategy":"validation","validationCode":"if (parameters.getRealm() == null || !parameters.getRealm().equalsIgnoreCase(handlerRealm)) {\n    throw new IllegalStateException(\"Realm mismatch: request=\" + parameters.getRealm() + \" handler=\" + handlerRealm);\n}","typeGuard":"boolean realmMatches(ClaimsParameters<?> p, String expected) {\n    return p.getRealm() != null && p.getRealm().equalsIgnoreCase(expected);\n}","tryCatchPattern":null,"preventionTips":["Keep a single source of truth for realm names shared by realm parser and claims handlers.","Log both realm values on startup to catch drift early.","Test multi-realm flows with each registered realm."],"tags":["sts","claims","realm-mismatch","ws-security"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}