{"record":{"id":"98a1a377c78011df","repo":"apereo/cas","slug":"endpoint-for-is-not-available-or-does-not-define","errorCode":null,"errorMessage":"Endpoint for  is not available or does not define a binding for ","messagePattern":"Endpoint for  is not available or does not define a binding for ","errorType":"exception","errorClass":"SamlException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java","lineNumber":119,"sourceCode":"     * @param adaptor      the adaptor\n     * @param binding      the binding\n     * @return the assertion consumer service\n     */\n    public static Endpoint determineEndpointForRequest(final Pair<? extends RequestAbstractType, MessageContext> authnContext,\n                                                       final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                       final String binding) {\n        var endpoint = (Endpoint) null;\n        val authnRequest = authnContext.getLeft();\n        if (authnRequest instanceof LogoutRequest) {\n            endpoint = adaptor.getSingleLogoutService(binding);\n        } else {\n            val acsEndpointFromReq = getAssertionConsumerServiceFromRequest(authnRequest, binding, adaptor);\n            val acsEndpointFromMetadata = adaptor.getAssertionConsumerService(binding);\n            endpoint = determineEndpointForRequest(authnRequest, adaptor, binding,\n                acsEndpointFromReq, acsEndpointFromMetadata, authnContext.getRight());\n        }\n        if (endpoint == null) {\n            throw new SamlException(\"Endpoint for \" + authnRequest.getSchemaType()\n                + \" is not available or does not define a binding for \" + binding);\n        }\n        val missingLocation = StringUtils.isBlank(endpoint.getResponseLocation()) && StringUtils.isBlank(endpoint.getLocation());\n        if (StringUtils.isBlank(endpoint.getBinding()) || missingLocation) {\n            throw new SamlException(\"Endpoint for \" + authnRequest.getSchemaType()\n                + \" does not define a binding or location for binding \" + binding);\n        }\n        return endpoint;\n    }\n\n    private static AssertionConsumerService determineEndpointForRequest(final RequestAbstractType authnRequest,\n                                                                        final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                                        final String binding,\n                                                                        @Nullable final AssertionConsumerService acsFromRequest,\n                                                                        final AssertionConsumerService acsFromMetadata,\n                                                                        final MessageContext authenticationContext) {\n        LOGGER.trace(\"ACS from authentication request is [{}], ACS from metadata is [{}] with binding [{}]\",\n            acsFromRequest, acsFromMetadata, binding);","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java#L101-L137","documentation":"SamlIdPUtils.determineEndpointForRequest() resolves the response endpoint for an AuthnRequest using the requested binding. If after checking metadata ACS, request-supplied ACS, and index-based lookup the endpoint is still null, it throws SamlException indicating the peer entity does not define an endpoint for that binding.","triggerScenarios":"preparePeerEntitySamlEndpointContext() calls determineEndpointForRequest with a binding (e.g. POST or Redirect) for which neither the request's AssertionConsumerServiceURL/index nor the metadata's AssertionConsumerService entries yield a matching endpoint, leaving endpoint null.","commonSituations":"SP metadata only declares a SOAP or Artifact binding while CAS is asked to respond with POST; AuthnRequest references an ACS index/binding absent from metadata; metadata is stale relative to the SP's current configuration.","solutions":["Add an AssertionConsumerService entry with the requested Binding (e.g. urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST) and Location to the SP metadata.","Check the AuthnRequest's ProtocolBinding/AssertionConsumerServiceIndex/URL against the metadata and align them.","Refresh the SP metadata in CAS so it reflects the SP's current ACS declarations.","Verify the `binding` parameter passed by the caller matches a binding the SP actually supports."],"exampleFix":"// before\n<md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" Location=\"https://sp.example.com/acs\" index=\"0\"/>\n\n// after\n<md:AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" Location=\"https://sp.example.com/acs\" index=\"0\" isDefault=\"true\"/>","handlingStrategy":"validation","validationCode":"// before responding\nboolean hasBinding = adaptor.getAssertionConsumerServices().stream()\n    .anyMatch(acs -> binding.equalsIgnoreCase(acs.getBinding()));\nif (!hasBinding) {\n    logger.warn(\"SP {} has no ACS for binding {}\", adaptor.getEntityId(), binding);\n}","typeGuard":null,"tryCatchPattern":"try {\n    endpoint = SamlIdPUtils.determineEndpointForRequest(authnRequest, adaptor, binding, fromReq, fromMeta, context);\n} catch (SamlException e) {\n    logger.error(\"No endpoint for binding {}: {}\", binding, e.getMessage());\n}","preventionTips":["Ensure SP metadata declares an HTTP-POST ACS (the most commonly requested binding).","Keep SP metadata refreshed so binding declarations stay current.","Log the AuthnRequest ProtocolBinding/index and compare to metadata when debugging."],"tags":["saml","idp","binding","metadata","endpoint"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}