{"record":{"id":"b4ee3edb34f63ce8","repo":"apereo/cas","slug":"no-nameid-could-be-determined-based-on-the-support","errorCode":null,"errorMessage":"No NameID could be determined based on the supported formats [{}]","messagePattern":"No NameID could be determined based on the supported formats \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java","lineNumber":168,"sourceCode":"            LOGGER.warn(\"Required NameID format [{}] in the AuthN request issued by [{}] is not supported based on the metadata for [{}]. \"\n                        + \"The requested NameID format may not be honored. You should consult the metadata for this service \"\n                        + \"and ensure the requested NameID format is present in the collection of supported \"\n                        + \"metadata formats in the metadata, which are the following: [{}]\",\n                requiredNameFormat, SamlIdPUtils.getIssuerFromSamlObject(context.getSamlRequest()),\n                context.getAdaptor().getEntityId(), context.getAdaptor().getSupportedNameIdFormats());\n        }\n    }\n\n    protected NameID determineNameId(final List<String> supportedNameFormats, final SamlProfileBuilderContext context) {\n        for (val nameFormat : supportedNameFormats) {\n            LOGGER.debug(\"Evaluating NameID format [{}]\", nameFormat);\n            val nameId = encodeNameIdBasedOnNameFormat(context, nameFormat);\n            if (nameId != null) {\n                LOGGER.debug(\"Determined NameID based on format [{}] to be [{}]\", nameFormat, nameId.getValue());\n                return nameId;\n            }\n        }\n        LOGGER.warn(\"No NameID could be determined based on the supported formats [{}]\", supportedNameFormats);\n        return null;\n    }\n\n    protected NameID encodeNameIdBasedOnNameFormat(final SamlProfileBuilderContext context,\n                                                   final String nameFormat) {\n        try {\n            val attribute = prepareNameIdAttribute(context, nameFormat);\n            val encoder = SamlAttributeBasedNameIdGenerator.get(Optional.of(context.getSamlRequest()),\n                nameFormat, context.getRegisteredService(), attribute);\n            context.getHttpRequest().setAttribute(NameID.class.getName(), attribute);\n            LOGGER.debug(\"Encoding NameID based on [{}]\", nameFormat);\n            val prc = new ProfileRequestContext();\n            val nameId = Objects.requireNonNull(encoder.generate(prc, nameFormat));\n            LOGGER.debug(\"Final NameID encoded with format [{}] has value [{}]\", nameId.getFormat(), nameId.getValue());\n            return nameId;\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n        }","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/nameid/SamlProfileSamlNameIdBuilder.java#L150-L186","documentation":"determineNameId iterated the service's supported NameID formats and, for each, encodeNameIdBasedOnNameFormat returned null, so no NameID could be produced for the subject. The builder logs a warning and returns null, causing the SSO response building to lack a subject NameID for that service.","triggerScenarios":"nameID -> determineNameId with supportedNameFormats where every call to encodeNameIdBasedOnNameFormat(context, nameFormat) fails/returns null (e.g. attribute needed for the format is missing, format unrecognized, encoder throws and returns null).","commonSituations":"Service configured with NameID formats whose source attributes are absent from the principal (e.g. persistent format without a persistent id, emailAddress format without email attribute); attribute release policy filtering out required attributes; typo/unsupported format string in service config.","solutions":["Check CAS logs above this warning for the per-format failure cause from encodeNameIdBasedOnNameFormat","Ensure the attributes required for each configured NameID format are resolvable and released by the service attribute release policy","Configure a supported, achievable default NameID format (e.g. transient or persistent) for the service","Verify the format URIs in the service config are valid SAML NameID format URIs"],"exampleFix":"// before (service config)\n\"supportedNameIdFormats\": [\"urn:oasis:names:tc:SAML:2.0:nameid-format:emailAddress\"]\n// after (either release email attribute or use a format needing no custom attribute)\n\"supportedNameIdFormats\": [\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\"]","handlingStrategy":"validation","validationCode":"// Ensure the principal has attributes needed by the configured formats before SSO\nval attrs = principal.getAttributes();\nval fmts = service.getSupportedNameIdFormats();\nif (fmts.contains(EMAIL_FORMAT) && !attrs.containsKey(\"email\")) {\n    LOGGER.warn(\"email attribute missing for emailAddress NameID format\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    val nameId = nameID(context);\n    if (nameId == null) {\n        // no NameID could be encoded: abort or use fallback format\n        throw new SamlException(\"No NameID produced for service \" + context.getAdaptor().getEntityId());\n    }\n} catch (Exception e) {\n    LOGGER.error(\"NameID generation failed\", e);\n}","preventionTips":["Release the attributes each configured NameID format requires via the attribute release policy","Prefer formats guaranteed by the IdP (e.g. transient) as defaults","Validate format URIs in service config against supported values","Enable DEBUG logging on SamlProfileSamlNameIdBuilder when onboarding SPs"],"tags":["saml","saml-idp","nameid","attribute-release"],"backgroundTag":"empty-result-set","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}