{"record":{"id":"af27cb27de1a0389","repo":"apereo/cas","slug":"retrieved-realm-from-cn-of-saml-assertion-certific","errorCode":null,"errorMessage":"Retrieved realm from CN of SAML assertion certificate [{}] does not match the CAS realm [{}]. Beware that realm mismatch does requires configuration to implement realm relationships or identity mapping","messagePattern":"Retrieved realm from CN of SAML assertion certificate \\[(.+?)\\] does not match the CAS realm \\[(.+?)\\]\\. Beware that realm mismatch does requires configuration to implement realm relationships or identity mapping","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/saml/SamlAssertionRealmCodec.java","lineNumber":34,"sourceCode":" * @author Misagh Moayyed\n * @since 5.1.0\n */\n@Slf4j\n@RequiredArgsConstructor\npublic class SamlAssertionRealmCodec implements SAMLRealmCodec {\n\n    private final String realm;\n\n    @Override\n    public String getRealmFromToken(final SamlAssertionWrapper assertion) {\n        val ki = assertion.getSignatureKeyInfo();\n        val certs = ki.getCerts();\n        val parsed = parseCNValue(certs[0].getSubjectX500Principal().getName());\n        LOGGER.debug(\"Realm parsed from certificate CN of the SAML assertion: [{}]\", parsed);\n        if (Strings.CI.equals(parsed, realm)) {\n            return parsed;\n        }\n        LOGGER.warn(\"Retrieved realm from CN of SAML assertion certificate [{}] does not match the CAS realm [{}]. \"\n                + \"Beware that realm mismatch does requires configuration to implement realm relationships or identity mapping\",\n            parsed, realm);\n        return parsed;\n    }\n\n    private static String parseCNValue(final String name) {\n        val matcher = RegexUtils.createPattern(\"cn=(\\\\w+)\").matcher(name);\n        if (matcher.find()) {\n            val commonName = matcher.group(1);\n            return commonName.toUpperCase(Locale.ENGLISH);\n        }\n        return null;\n    }\n}\n","sourceCodeStart":16,"sourceCodeEnd":49,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-ws-sts-api/src/main/java/org/apereo/cas/support/saml/SamlAssertionRealmCodec.java#L16-L49","documentation":"SamlAssertionRealmCodec.getRealmFromToken derives the realm from the CN of the certificate used to sign the SAML assertion. When that CN does not equal (case-insensitively) the configured CAS realm it logs this warning and still returns the parsed CN. The warning flags that cross-realm trust/identity mapping may be missing.","triggerScenarios":"A SAML assertion is signed with a certificate whose subject CN names a different realm than the CAS STS realm handling the request.","commonSituations":"Federation across realms where partner certificates carry their own realm CN; certificate rotated/reissued with a different CN; configuration updated to a new realm name but partner cert CN not updated; missing realm-relationship/identity-mapping configuration.","solutions":["Reissue or select a signing certificate whose CN matches the configured CAS realm.","Update the CAS realm configuration to match the CN used by the partner certificate.","If cross-realm use is intentional, configure realm relationships/identity mapping so downstream logic handles the mismatch.","Treat the returned parsed value (not the configured realm) as effective downstream; verify consumers accept it."],"exampleFix":"// before\n// cert CN=REALM_X, configured realm REALM_A -> warning\n// after: configure realm relationships or align names\nrealm = \"REALM_X\"; // matches certificate CN","handlingStrategy":"validation","validationCode":"String cn = parseCNValue(cert.getSubjectX500Principal().getName());\nif (!cn.equalsIgnoreCase(configuredRealm)) {\n    LOGGER.warn(\"Certificate CN realm {} differs from configured realm {}; ensure realm mapping exists\", cn, configuredRealm);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Issue partner certificates with CN equal to the realm name.","Document cross-realm relationships explicitly in configuration.","Alert on this warning in log monitoring since it often indicates trust misconfiguration."],"tags":["saml","sts","certificate","realm-mismatch"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}