{"record":{"id":"b3490a5c602830d8","repo":"apereo/cas","slug":"trust-anchor-requires-no-authority-hints","errorCode":null,"errorMessage":"Trust anchor requires no authority hints","messagePattern":"Trust anchor requires no authority hints","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java","lineNumber":90,"sourceCode":"                throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for OpenID Provider\");\n            }\n            issuer = settings.getIssuer();\n\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"OpenID provider requires authority hint(s)\");\n            }\n\n            val json = JSONValue.parse(settings.toJson());\n            metadata.put(EntityType.OPENID_PROVIDER.getValue(), json);\n\n        } else if (role == OidcFederationRole.INTERMEDIATE) {\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Intermediate requires authority hint(s)\");\n            }\n\n        } else if (role == OidcFederationRole.TRUST_ANCHOR) {\n            if (!authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Trust anchor requires no authority hints\");\n            }\n\n        } else {\n            throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for Trust Anchor/Intermediate\");\n        }\n\n        val federationMetadata = buildMetadata(issuer);\n        metadata.put(EntityType.FEDERATION_ENTITY.getValue(), federationMetadata.toJSONObject());\n\n        return buildEntityStatement(issuer, issuer, metadata, null, authorityHints);\n    }\n}\n","sourceCodeStart":72,"sourceCodeEnd":103,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java#L72-L103","documentation":"A Trust Anchor sits at the top of a federation and by definition must not declare authority hints. getWellKnownDiscoveryConfiguration() throws this IllegalArgumentException when role is TRUST_ANCHOR but cas.oidc.federation.authority-hints is non-empty.","triggerScenarios":"Deployment role set to TRUST_ANCHOR while leftover authority-hints entries remain in cas.oidc.federation config.","commonSituations":"An entity was demoted from intermediate/OP to trust anchor but hints were not removed; shared config template carries hints across roles; copy-pasted config from a subordinate deployment.","solutions":["Remove all entries from cas.oidc.federation.authority-hints for the trust anchor deployment","Confirm role=TRUST_ANCHOR is intentional (no superior entity)","If hints are required, this entity is not a trust anchor: set role to INTERMEDIATE or OPENID_PROVIDER"],"exampleFix":"// before\ncas.oidc.federation.role=TRUST_ANCHOR\ncas.oidc.federation.authority-hints=https://ta.example.org\n// after\ncas.oidc.federation.role=TRUST_ANCHOR\n# authority-hints removed","handlingStrategy":"validation","validationCode":"if (role == OidcFederationRole.TRUST_ANCHOR && !oidcProperties.getFederation().getAuthorityHints().isEmpty()) {\n    throw new IllegalStateException(\"Trust anchor must have no authority hints\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip authority-hints when promoting an entity to trust anchor","Use role-specific config templates to avoid leftovers"],"tags":["configuration","oidc-federation","authority-hints"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}