{"record":{"id":"ebf54cbb5f2e529e","repo":"spring-projects/spring-security","slug":"relying-party-registration-not-found-ebf54c","errorCode":"relying_party_registration_not_found","errorMessage":"registration not found","messagePattern":"registration not found","errorType":"error_code","errorClass":"Saml2AuthenticationException","httpStatus":401,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java","lineNumber":268,"sourceCode":"\t\t\tthis.relyingPartyRegistrationResolver = relyingPartyRegistrationResolver;\n\t\t}\n\n\t\t@Override\n\t\tpublic @Nullable Saml2LogoutRequestValidatorParameters resolve(HttpServletRequest request,\n\t\t\t\t@Nullable Authentication authentication) {\n\t\t\tString serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST);\n\t\t\tif (serialized == null) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tRequestMatcher.MatchResult result = this.logoutRequestMatcher.matcher(request);\n\t\t\tif (!result.isMatch()) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\tString registrationId = getRegistrationId(result, authentication);\n\t\t\tRelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request,\n\t\t\t\t\tregistrationId);\n\t\t\tif (registration == null) {\n\t\t\t\tthrow new Saml2AuthenticationException(\n\t\t\t\t\t\tSaml2Error.relyingPartyRegistrationNotFound(\"registration not found\"));\n\t\t\t}\n\t\t\tUriResolver uriResolver = RelyingPartyRegistrationPlaceholderResolvers.uriResolver(request, registration);\n\t\t\tString entityId = uriResolver.resolve(registration.getEntityId());\n\t\t\tentityId = Objects.requireNonNull(entityId);\n\t\t\tString logoutLocation = uriResolver.resolve(registration.getSingleLogoutServiceLocation());\n\t\t\tString logoutResponseLocation = uriResolver.resolve(registration.getSingleLogoutServiceResponseLocation());\n\t\t\tregistration = registration.mutate()\n\t\t\t\t.entityId(entityId)\n\t\t\t\t.singleLogoutServiceLocation(logoutLocation)\n\t\t\t\t.singleLogoutServiceResponseLocation(logoutResponseLocation)\n\t\t\t\t.build();\n\t\t\tSaml2MessageBinding saml2MessageBinding = Saml2MessageBindingUtils.resolveBinding(request);\n\t\t\tSaml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration)\n\t\t\t\t.samlRequest(serialized)\n\t\t\t\t.relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE))\n\t\t\t\t.binding(saml2MessageBinding)\n\t\t\t\t.parameters((params) -> params.put(Saml2ParameterNames.SIG_ALG,","sourceCodeStart":250,"sourceCodeEnd":286,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2LogoutRequestFilter.java#L250-L286","documentation":"Saml2LogoutRequestFilter resolves the RelyingPartyRegistration for the registrationId extracted from the logout request (via the Resolver resolve step). When the registration resolver returns null — i.e. no registered relying party matches the request's registration id — the filter throws a Saml2AuthenticationException with the relyingPartyRegistrationNotFound error. Spring Security cannot build the logout flow without knowing the entity IDs, keys, and SLO endpoints associated with the registration.","triggerScenarios":"A SAML 2.0 LogoutRequest/LogoutResponse arrives at /logout/saml2/slo and getRegistrationId derives an id (from a stored authentication or request parameter) that this.relyingPartyRegistrationResolver.resolve(request, registrationId) cannot map to a configured RelyingPartyRegistration.","commonSituations":"Registration was removed or renamed in application config after the user's session/authentication was created; relyingPartyRegistrationRepository does not contain the id referenced by the identity provider (e.g. metadata changed, AP 's' entityID mismatch); multi-tenant setups where a relyingPartyRegistrationRepository is scoped per tenant and the request hits the wrong tenant; spelling/case mismatch in registrationId.","solutions":["Verify the RelyingPartyRegistrationRepository registered in the Saml2LogoutConfigurer contains a registration whose registrationId matches the id sent/referenced by the logout request.","Check that the AP's LogoutRequest references an Issuer/entityID that your registrations match; fix relyingPartyRegistrationResolver or repository lookup so it resolves by the same id used to create the authentication.","For dynamic/multi-tenant repositories, ensure the resolve() implementation returns the correct registration for this request (not null) and that tenant resolution runs before the logout filter.","If the registration was legitimately deleted, invalidate the session/authentication so stale registrationIds are not replayed into the logout flow."],"exampleFix":"// before: repository missing the id used by the IdP\n@Bean\nRelyingPartyRegistrationRepository repo() {\n    return new InMemoryRelyingPartyRegistrationRepository(idpA); // only 'idp-a'\n}\n// after: include the registration the IdP references\n@Bean\nRelyingPartyRegistrationRepository repo() {\n    return new InMemoryRelyingPartyRegistrationRepository(idpA, idpB);\n}","handlingStrategy":"validation","validationCode":"String registrationId = /* id from request/session */;\nRelyingPartyRegistration reg = repository.findByRegistrationId(registrationId);\nif (reg == null) {\n    throw new ResponseStatusException(HttpStatus.NOT_FOUND,\n            \"Unknown registrationId: \" + registrationId);\n}","typeGuard":null,"tryCatchPattern":"try {\n    filter.doFilterInternal(request, response, chain);\n} catch (Saml2AuthenticationException ex) {\n    if (Saml2Error.RELYING_PARTY_REGISTRATION_NOT_FOUND.equals(ex.getSaml2Error().getCode())) {\n        response.sendError(HttpServletResponse.SC_BAD_REQUEST, ex.getMessage());\n    } else { throw ex; }\n}","preventionTips":["Keep registrationIds stable; never rename or delete a registration without migrating sessions.","Write a startup test asserting every registrationId the IdP references exists in your repository.","For multi-tenant apps, resolve tenant context before the SAML filters run."],"tags":["saml2","spring-security","logout","configuration"],"backgroundTag":"entity-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}