{"record":{"id":"94d4bf305fe5d4be","repo":"apereo/cas","slug":"is-not-found-in-the-registry-or-service-acces","errorCode":null,"errorMessage":"[{}] is not found in the registry or service access is denied.","messagePattern":"\\[(.+?)\\] is not found in the registry or service access is denied\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/AbstractSamlIdPProfileHandlerController.java","lineNumber":148,"sourceCode":"    }\n\n    protected Optional<SamlRegisteredServiceMetadataAdaptor> getSamlMetadataFacadeFor(\n        final SamlRegisteredService registeredService, final String entityId) {\n        return SamlRegisteredServiceMetadataAdaptor.get(\n            configurationContext.getSamlRegisteredServiceCachingMetadataResolver(), registeredService, entityId);\n    }\n\n    protected SamlRegisteredService verifySamlRegisteredService(final String serviceId,\n                                                                final HttpServletRequest request) {\n        if (StringUtils.isBlank(serviceId)) {\n            throw UnauthorizedServiceException.denied(\"Could not verify/locate SAML registered service since no serviceId is provided\");\n        }\n        val service = configurationContext.getWebApplicationServiceFactory().createService(serviceId, request);\n        service.getAttributes().put(SamlProtocolConstants.PARAMETER_ENTITY_ID, CollectionUtils.wrapList(serviceId));\n        LOGGER.debug(\"Checking service access in CAS service registry for [{}]\", service);\n        val registeredService = configurationContext.getServicesManager().findServiceBy(service, SamlRegisteredService.class);\n        if (registeredService == null || !registeredService.getAccessStrategy().isServiceAccessAllowed(registeredService, service)) {\n            LOGGER.warn(\"[{}] is not found in the registry or service access is denied.\", serviceId);\n            throw UnauthorizedServiceException.denied(\"Rejected: %s\".formatted(serviceId));\n        }\n        LOGGER.debug(\"Located SAML service in the registry as [{}] with the metadata location of [{}]\",\n            registeredService.getServiceId(), registeredService.getMetadataLocation());\n        return registeredService;\n    }\n\n    protected AuthenticatedAssertionContext buildCasAssertion(final Authentication authentication,\n                                                              final Service service,\n                                                              final RegisteredService registeredService,\n                                                              final Map<String, List<Object>> attributesToCombine) throws Throwable {\n        val context = RegisteredServiceAttributeReleasePolicyContext.builder()\n            .registeredService(registeredService)\n            .applicationContext(getConfigurationContext().getOpenSamlConfigBean().getApplicationContext())\n            .service(service)\n            .principal(authentication.getPrincipal())\n            .build();\n        val attributes = registeredService.getAttributeReleasePolicy().getAttributes(context);","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/AbstractSamlIdPProfileHandlerController.java#L130-L166","documentation":"CAS's SAML IdP could not locate the requesting SP entityID in the service registry, or the service's access strategy explicitly denied access for the incoming request. verifySamlRegisteredService resolves the entityID as a SamlRegisteredService via ServicesManager.findServiceBy and checks isServiceAccessAllowed; on failure it throws UnauthorizedServiceException.denied. This is a deliberate rejection of an unregistered or disallowed service provider.","triggerScenarios":"Any SAML IdP profile request (SSO/SLO endpoints) whose issuer/entityID matches no SamlRegisteredService in the registry, or whose registered service's access strategy (e.g. disabled service, case-sensitive attribute/cas-allowlist rules in isServiceAccessAllowed) rejects the constructed web application service.","commonSituations":"SP entityID typo or case mismatch versus the service definition's serviceId pattern; service definition not loaded (JSON/YAML registry files not picked up, wrong regex); service marked disabled or expired; access strategy restricting by IP or relying-party attributes; changes after service registry refresh not yet propagated.","solutions":["Verify a SamlRegisteredService exists whose serviceId regex matches the incoming entityID exactly (check case and trailing slashes) in the configured service registry.","Check the service's accessStrategy in the service definition JSON: ensure it is not disabled, expired, and that unauthorized/url policies do not reject the request.","Confirm the service registry source (JSON files, JDBC, etc.) is correctly configured and the service was actually loaded — inspect /cas actuator services endpoint or registry logs.","Enable DEBUG logging for org.apereo.cas.support.saml to see the constructed service object and why findServiceBy returned nothing."],"exampleFix":"// before: entityID 'https://sp.example.com/shib' but service definition pattern only matches https://sp.example.com\n{\n  \"@class\": \"org.apereo.cas.support.saml.services.SamlRegisteredService\",\n  \"serviceId\": \"https://sp\\.example\\.com\",\n  ...\n}\n// after: widen/fix the pattern to match the SP's actual entityID\n{\n  \"@class\": \"org.apereo.cas.support.saml.services.SamlRegisteredService\",\n  \"serviceId\": \"https://sp\\.example\\.com/shib\",\n  ...\n}","handlingStrategy":"validation","validationCode":"// Admin-side pre-check against the CAS registry\nval service = servicesManager.findServiceBy(entityId, SamlRegisteredService.class);\nif (service == null || !service.getAccessStrategy().isServiceAccessAllowed(service, webAppService)) {\n    throw new IllegalArgumentException(\"SP entityID not registered or access denied: \" + entityId);\n}","typeGuard":"boolean isServiceUsable(SamlRegisteredService s) { return s != null && !s.getAccessStrategy().isServiceAccessAllowed(s, s.getServiceId()) == false; }","tryCatchPattern":"try {\n    verifySamlRegisteredService(issuer, request);\n} catch (UnauthorizedServiceException e) {\n    LOGGER.error(\"SP not in registry or denied: {}\", issuer, e);\n    // return 403 / friendly error page\n}","preventionTips":["Keep serviceId regexes anchored and tested against the real SP entityID.","Audit service definitions for disabled/expired state on every registry change.","Monitor the 'is not found in the registry' warn log as a misconfiguration signal."],"tags":["saml","service-registry","unauthorized-service","cas"],"backgroundTag":"permission-denied","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}