{"record":{"id":"a445ab88451dbeb0","repo":"apereo/cas","slug":"saml-metadata-resolver-obtained-from-the-cach","errorCode":null,"errorMessage":"SAML metadata resolver [{}] obtained from the cache is unable to produce/resolve valid metadata from [{}]. Metadata resolver cache entry with key [{}] has been invalidated.","messagePattern":"SAML metadata resolver \\[(.+?)\\] obtained from the cache is unable to produce/resolve valid metadata from \\[(.+?)\\]\\. Metadata resolver cache entry with key \\[(.+?)\\] has been invalidated\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/cache/SamlRegisteredServiceDefaultCachingMetadataResolver.java","lineNumber":87,"sourceCode":"    public CachedMetadataResolverResult resolve(final SamlRegisteredService service, final CriteriaSet criteriaSet) throws Exception {\n        val metadataLocation = SpringExpressionLanguageValueResolver.getInstance().resolve(service.getMetadataLocation());\n        LOGGER.debug(\"Resolving metadata for [{}] at [{}]\", service.getName(), metadataLocation);\n        val cacheKey = new SamlRegisteredServiceCacheKey(service, criteriaSet);\n        return FunctionUtils.doAndRetry(\n            new Retryable<>() {\n                @Override\n                public @Nullable CachedMetadataResolverResult execute() throws Throwable {\n                    LOGGER.debug(\"Locating cached metadata resolver using key [{}] for service [{}].\",\n                        cacheKey.getId(), service.getName());\n                    val queryResult = locateAndCacheMetadataResolver(service, criteriaSet, cacheKey);\n                    val result = isMetadataResolverAcceptable(queryResult, criteriaSet);\n                    if (!result.isValid()) {\n                        val criteria = new EvaluableEntityRoleEntityDescriptorCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME);\n                        val count = Iterables.size(result.getResult().getMetadataResolver().resolve(new CriteriaSet(criteria)));\n                        if (count == 1) {\n                            invalidate(service, criteriaSet);\n                        }\n                        LOGGER.warn(\"SAML metadata resolver [{}] obtained from the cache is \"\n                                + \"unable to produce/resolve valid metadata from [{}]. Metadata resolver cache entry with key [{}] \"\n                                + \"has been invalidated.\", result.getResult().getMetadataResolver().getId(), metadataLocation, cacheKey.getId());\n                        throw new SamlException(\"Unable to locate a valid SAML metadata resolver for \"\n                            + metadataLocation + \" to locate \" + criteriaSet);\n                    }\n                    return queryResult.getResult();\n                }\n            },\n            casProperties.getAuthn().getSamlIdp().getMetadata().getCore().getMaximumRetryAttempts());\n    }\n\n    @Override\n    public void invalidate() {\n        LOGGER.trace(\"Invalidating cache, removing all metadata resolvers\");\n        cache.invalidateAll();\n    }\n\n    @Override","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/cache/SamlRegisteredServiceDefaultCachingMetadataResolver.java#L69-L105","documentation":"A SamlException thrown by SamlRegisteredServiceDefaultCachingMetadataResolver.execute when a cached metadata resolver result is invalid. If the resolver cannot produce exactly one SPSSODescriptor for the requested criteria, CAS invalidates the cache entry and throws because no valid SAML metadata resolver exists for the requested service/entity. Typically indicates the cached metadata lacks the expected SP role descriptor.","triggerScenarios":"Querying the caching metadata resolver (getMetadataResolverForSamlRegisteredService / resolve paths) with a CriteriaSet for a service whose metadata does not contain an SPSSODescriptor, or whose cached resolver result was marked invalid (result.isValid() == false).","commonSituations":"SP metadata uploaded/published without an SPSSODescriptor (e.g. IdP-only metadata file); metadataLocation pointing at the wrong entity's metadata; cached entry went stale after upstream metadata changed; entityID in the service config does not match any EntityDescriptor in the metadata.","solutions":["Verify the service's entityID (serviceId) actually exists as an EntityDescriptor with an SPSSODescriptor in the configured metadataLocation.","Inspect the metadata XML at metadataLocation; regenerate/re-upload correct SP metadata.","Invalidate/flush the metadata resolver cache (or restart) so the invalid entry is rebuilt from source.","Confirm metadata signing/refresh settings so the underlying resolver re-fetches current metadata instead of serving a broken cached copy.","Enable DEBUG logging for org.apereo.cas.support.saml.metadata.cache to trace which resolver/cache key failed."],"exampleFix":"// before: entityID not present in metadata, causing invalid cached result\nsetServiceId(\"https://sp.example.org/shibboleth\") // no such entity in metadata\n// after: use the entityID declared in the SP metadata file\nsetServiceId(\"https://sp.example.org/sp\") // matches <EntityDescriptor entityID=...> with SPSSODescriptor","handlingStrategy":"try-catch","validationCode":"// Validate that the entity has an SPSSODescriptor before requesting a cached resolver\nvar crit = new CriteriaSet(\n    new EntityIdCriterion(service.getServiceId()),\n    new EvaluableEntityRoleEntityDescriptorCriterion(SPSSODescriptor.DEFAULT_ELEMENT_NAME));\nif (metadataResolver.resolveSingle(crit) == null) {\n    throw new SamlException(\"Metadata for \" + service.getServiceId() + \" contains no SPSSODescriptor\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    var result = cachingResolver.resolve(metadataLocation, criteriaSet);\n} catch (SamlException e) {\n    LOGGER.error(\"No valid metadata resolver for {}: verify entityID and SPSSODescriptor in metadataLocation\", metadataLocation, e);\n    // evict cache entry and/or surface an actionable error to the SP flow\n}","preventionTips":["Confirm the entityID in the service definition matches an EntityDescriptor with an SPSSODescriptor in the metadata source","Validate metadata files with a schema/role check before uploading them as metadataLocation","Flush the metadata cache after updating upstream metadata","Enable DEBUG logging for the metadata cache when diagnosing invalid cached resolvers"],"tags":["saml","metadata","cache","entity-descriptor"],"backgroundTag":"schema-validation-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}