{"record":{"id":"eb23ff553270e579","repo":"apereo/cas","slug":"no-assertion-consumer-service-could-be-found-for-e","errorCode":null,"errorMessage":"No assertion consumer service could be found for entity ","messagePattern":"No assertion consumer service could be found for entity ","errorType":"exception","errorClass":"SamlException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java","lineNumber":85,"sourceCode":"    }\n\n\n    /**\n     * Prepare peer entity saml endpoint.\n     *\n     * @param authnContext    the authn context\n     * @param outboundContext the outbound context\n     * @param adaptor         the adaptor\n     * @param binding         the binding\n     * @throws SamlException the saml exception\n     */\n    public static void preparePeerEntitySamlEndpointContext(final Pair<? extends RequestAbstractType, MessageContext> authnContext,\n                                                            final MessageContext outboundContext,\n                                                            final SamlRegisteredServiceMetadataAdaptor adaptor,\n                                                            final String binding) throws SamlException {\n        val entityId = adaptor.getEntityId();\n        if (!adaptor.containsAssertionConsumerServices()) {\n            throw new SamlException(\"No assertion consumer service could be found for entity \" + entityId);\n        }\n\n        val peerEntityContext = outboundContext.ensureSubcontext(SAMLPeerEntityContext.class);\n        peerEntityContext.setEntityId(entityId);\n\n        val endpointContext = peerEntityContext.ensureSubcontext(SAMLEndpointContext.class);\n        val endpoint = determineEndpointForRequest(authnContext, adaptor, binding);\n        LOGGER.debug(\"Configured peer entity endpoint to be [{}] with binding [{}]\", endpoint.getLocation(), endpoint.getBinding());\n        endpointContext.setEndpoint(endpoint);\n    }\n\n    /**\n     * Determine assertion consumer service assertion consumer service.\n     *\n     * @param authnContext the authn context\n     * @param adaptor      the adaptor\n     * @param binding      the binding\n     * @return the assertion consumer service","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-core/src/main/java/org/apereo/cas/support/saml/SamlIdPUtils.java#L67-L103","documentation":"SamlIdPUtils.preparePeerEntitySamlEndpointContext() builds the outbound OpenSAML message context for a peer SP. Before wiring the peer entity and endpoint contexts it checks adaptor.containsAssertionConsumerServices(); if the SP's SAML metadata exposes no AssertionConsumerService entries, it throws a SamlException because there is nowhere to send the response.","triggerScenarios":"Calling preparePeerEntitySamlEndpointContext() with a SamlRegisteredServiceMetadataAdaptor whose resolved metadata for entityId contains an SPSSODescriptor with zero AssertionConsumerService elements (or no SPSSODescriptor ACS at all).","commonSituations":"SP metadata uploaded/published contains only an IDPSSODescriptor, metadata was hand-edited and ACS elements stripped, or the metadata document is for the wrong entityID so the adaptor resolves an SP entry without ACS.","solutions":["Inspect the SP metadata at the configured metadataLocation and add at least one <md:AssertionConsumerService> with Binding and Location to the SPSSODescriptor.","Confirm the entityID used to resolve metadata matches the SP that actually declares ACS entries.","Re-fetch/re-import the SP metadata from the vendor if it was truncated or hand-edited.","Guard the call site: check adaptor.containsAssertionConsumerServices() before invoking and fail with a clearer service-level error."],"exampleFix":"// before\nSamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding); // throws\n\n// after\nif (!adaptor.containsAssertionConsumerServices()) {\n    throw new SamlException(\"SP metadata for \" + adaptor.getEntityId() + \" has no ACS; fix metadata before proceeding\");\n}\nSamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding);","handlingStrategy":"validation","validationCode":"// before building the outbound context\nif (!adaptor.containsAssertionConsumerServices()) {\n    throw new SamlException(\"SP metadata for \" + adaptor.getEntityId() + \" declares no ACS\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    SamlIdPUtils.preparePeerEntitySamlEndpointContext(authnContext, outboundContext, adaptor, binding);\n} catch (SamlException e) {\n    logger.error(\"Cannot resolve SP endpoint: {} — check SP metadata ACS entries\", e.getMessage());\n}","preventionTips":["Validate SP metadata with an XML schema validator at import time, requiring at least one ACS.","Pin entityIDs and metadata sources so the wrong entity cannot be resolved.","Re-import vendor metadata rather than hand-editing it."],"tags":["saml","idp","metadata","acs","openid-connector"],"backgroundTag":"resource-not-found","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}