{"record":{"id":"b89e13409e241604","repo":"spring-projects/spring-security","slug":"relying-party-registration-not-found","errorCode":"relying_party_registration_not_found","errorMessage":"No relying party registration found","messagePattern":"No relying party registration found","errorType":"error_code","errorClass":"Saml2AuthenticationException","httpStatus":401,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2WebSsoAuthenticationFilter.java","lineNumber":138,"sourceCode":"\t\tsetAuthenticationConverter(authenticationConverter);\n\t}\n\n\t@Override\n\tprotected boolean requiresAuthentication(HttpServletRequest request, HttpServletResponse response) {\n\t\treturn super.requiresAuthentication(request, response);\n\t}\n\n\t@Override\n\tpublic @Nullable Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)\n\t\t\tthrows AuthenticationException {\n\t\tAuthentication authentication = this.authenticationConverter.convert(request);\n\t\tif (authentication == null) {\n\t\t\tif (this.continueChainWhenNoRelyingPartyRegistrationFound) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tSaml2Error saml2Error = new Saml2Error(Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND,\n\t\t\t\t\t\"No relying party registration found\");\n\t\t\tthrow new Saml2AuthenticationException(saml2Error);\n\t\t}\n\t\tsetDetails(request, authentication);\n\t\tthis.authenticationRequestRepository.removeAuthenticationRequest(request, response);\n\t\treturn getAuthenticationManager().authenticate(authentication);\n\t}\n\n\t/**\n\t * Use the given {@link Saml2AuthenticationRequestRepository} to remove the saved\n\t * authentication request. If the {@link #authenticationConverter} is of the type\n\t * {@link Saml2AuthenticationTokenConverter}, the\n\t * {@link Saml2AuthenticationRequestRepository} will also be set into the\n\t * {@link #authenticationConverter}.\n\t * @param authenticationRequestRepository the\n\t * {@link Saml2AuthenticationRequestRepository} to use\n\t * @since 5.6\n\t */\n\tpublic void setAuthenticationRequestRepository(\n\t\t\tSaml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository) {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2WebSsoAuthenticationFilter.java#L120-L156","documentation":"Saml2WebSsoAuthenticationFilter.attemptAuthentication could not find a RelyingPartyRegistration matching the incoming SAMLResponse (via the stored AuthnRequest / registrationId resolved from the request). Unless continueChainWhenNoRelyingPartyRegistrationFound is enabled, it throws Saml2AuthenticationException with code relying_party_registration_not_found. It means the SP has no registration configured for the IDP that responded.","triggerScenarios":"A SAMLResponse arrives at the SSO endpoint but the resolved registrationId has no matching RelyingPartyRegistration, or no authentication request was found for this request (e.g. unsolicited response / IDP-initiated SSO without matching registration).","commonSituations":"Registration removed or renamed after the user started SSO; multiple IDPs and the response's issuer isn't in the config; load-balanced nodes with different saml2 registration configs; IDP-initiated SSO where the SP only supports SP-initiated; expired/cleared HttpSession losing the saved authentication request.","solutions":["Add or fix the RelyingPartyRegistration for the responding IDP (correct entityId/issuer metadata) in the RelyingPartyRegistrationRepository","Confirm all nodes behind the load balancer share the same security configuration","For IDP-initiated SSO, ensure the registration exists and matches the IdP entityID, or enable idpInitiatedLogin if supported","Call saml2Login continuation via .saml2Login(Customizer.withDefaults()) and consider continueChainWhenNoRelyingPartyRegistrationFound if you want to pass through unhandled responses","Verify the saved Saml2AuthenticationRequest still exists (session replication, sticky sessions)"],"exampleFix":"// before\nhttp.saml2Login(Customizer.withDefaults()); // registration id \"adfs\" only, IDP sends entityID \"https://adfs.example.com/adfs/services/trust\"\n// after: align registration with the IDP's actual entityID\nhttp.saml2Login(saml2 -> saml2.relyingPartyRegistration(r -> r\n    .registrationId(\"adfs\")\n    .entityId(\"https://adfs.example.com/adfs/services/trust\")\n    .assertingParty(p -> p.entityId(\"https://adfs.example.com/adfs/services/trust\"))));","handlingStrategy":"try-catch","validationCode":"String registrationId = /* resolved from request/session */;\nif (registrations.findByRegistrationId(registrationId) == null) {\n    log.warn(\"No RelyingPartyRegistration for id \" + registrationId);\n}","typeGuard":null,"tryCatchPattern":"try { /* sso filter chain runs */ } catch (Saml2AuthenticationException ex) {\n    if (Saml2ErrorCodes.RELYING_PARTY_REGISTRATION_NOT_FOUND.equals(ex.getSaml2Error().getErrorCode())) {\n        log.warn(\"SAMLResponse from unconfigured IDP\", ex);\n        response.sendError(HttpServletResponse.SC_BAD_REQUEST);\n    } else { throw ex; }\n}","preventionTips":["Keep registrations in sync across all instances (shared config/DB)","Verify the registration entityId matches each IDP's entityID","Use metadata import instead of hand-written entityIds","Enable session replication so saved AuthnRequests survive failover"],"tags":["saml2","spring-security","configuration","relying-party-registration"],"backgroundTag":"resource-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}