{"record":{"id":"b3696ffce63b6f82","repo":"apereo/cas","slug":"openid-provider-requires-authority-hint-s","errorCode":null,"errorMessage":"OpenID provider requires authority hint(s)","messagePattern":"OpenID provider requires authority hint\\(s\\)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java","lineNumber":77,"sourceCode":"\n        val error = retrieveInvalidIssuerError(request, response, OidcConstants.FETCH_FEDERATION_URL);\n        if (error != null) {\n            return error;\n        }\n\n        val role = oidcProperties.getFederation().getRole();\n        val settings = serverDiscoverySettings.getIfAvailable();\n        var issuer = oidcProperties.getCore().getIssuer();\n        val metadata = new JSONObject();\n        val authorityHints = oidcProperties.getFederation().getAuthorityHints().stream().map(EntityID::new).toList();\n        if (settings != null) {\n            if (role != OidcFederationRole.OPENID_PROVIDER) {\n                throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for OpenID Provider\");\n            }\n            issuer = settings.getIssuer();\n\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"OpenID provider requires authority hint(s)\");\n            }\n\n            val json = JSONValue.parse(settings.toJson());\n            metadata.put(EntityType.OPENID_PROVIDER.getValue(), json);\n\n        } else if (role == OidcFederationRole.INTERMEDIATE) {\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Intermediate requires authority hint(s)\");\n            }\n\n        } else if (role == OidcFederationRole.TRUST_ANCHOR) {\n            if (!authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Trust anchor requires no authority hints\");\n            }\n\n        } else {\n            throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for Trust Anchor/Intermediate\");\n        }","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java#L59-L95","documentation":"An OpenID Provider entity in an OIDC federation must list at least one authority hint (its superior entity). getWellKnownDiscoveryConfiguration() throws this IllegalArgumentException when role is OPENID_PROVIDER, discovery settings exist, but cas.oidc.federation.authority-hints is empty.","triggerScenarios":"Deployment configured as OPENID_PROVIDER with OP discovery settings but cas.oidc.federation.authority-hints is unset or an empty list, while the well-known federation endpoint is initialized.","commonSituations":"Standalone OP being onboarded into a federation without adding its intermediate/trust-anchor to authority-hints; hints accidentally cleared during config refactor.","solutions":["Add at least one superior entity ID to cas.oidc.federation.authority-hints","Ensure hints reference valid entity IDs of the trust anchor/intermediate above this OP","If the entity truly has no superior, change the role to TRUST_ANCHOR instead"],"exampleFix":"// before\ncas.oidc.federation.role=OPENID_PROVIDER\n# authority-hints empty\n// after\ncas.oidc.federation.authority-hints=https://ta.example.org\ncas.oidc.federation.role=OPENID_PROVIDER","handlingStrategy":"validation","validationCode":"if (List.of(OPENID_PROVIDER, INTERMEDIATE).contains(role) && oidcProperties.getFederation().getAuthorityHints().isEmpty()) {\n    throw new IllegalStateException(\"Role \" + role + \" requires at least one authority hint\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set authority-hints for non-trust-anchor roles","Reference reachable superior entity IDs","Add a config validation step in CI"],"tags":["configuration","oidc-federation","authority-hints"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}