{"record":{"id":"ef8ffe2ee6a4f78a","repo":"apereo/cas","slug":"no-assertion-or-its-configuration-was-provided-to","errorCode":null,"errorMessage":"No assertion or its configuration was provided to validate signatures","messagePattern":"No assertion or its configuration was provided to validate signatures","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java","lineNumber":252,"sourceCode":"    /**\n     * Gets assertion from security token.\n     *\n     * @param reqToken the req token\n     * @return the assertion from security token\n     */\n    public XMLObject getAssertionFromSecurityToken(final RequestedSecurityToken reqToken) {\n        return reqToken.getSecurityTokens().getFirst();\n    }\n\n    /**\n     * validateSignature checks to see if the signature on an assertion is valid.\n     *\n     * @param resultPair a provided assertion\n     * @return true if the assertion's signature is valid, otherwise false\n     */\n    public boolean validateSignature(final Pair<Assertion, WsFederationConfiguration> resultPair) {\n        if (resultPair == null) {\n            LOGGER.warn(\"No assertion or its configuration was provided to validate signatures\");\n            return false;\n        }\n        val configuration = resultPair.getValue();\n        val assertion = resultPair.getKey();\n\n        if (assertion == null || configuration == null) {\n            LOGGER.warn(\"No signature or configuration was provided to validate signatures\");\n            return false;\n        }\n        val signature = assertion.getSignature();\n        if (signature == null) {\n            LOGGER.warn(\"No signature is attached to the assertion to validate\");\n            return false;\n        }\n        try {\n            LOGGER.debug(\"Validating the signature...\");\n            val validator = new SAMLSignatureProfileValidator();\n            validator.validate(signature);","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-wsfederation/src/main/java/org/apereo/cas/support/wsfederation/WsFederationHelper.java#L234-L270","documentation":"WsFederationHelper.validateSignature validates the signature of a SAML assertion paired with its WsFederationConfiguration. If the Pair itself is null it logs this warning and returns false, since there is nothing to validate. Callers treat false as failed credential validation.","triggerScenarios":"A previous parsing step (e.g. extracting/assertion building from the wresult) returned null and that null pair was passed directly into validateSignature.","commonSituations":"Broken wresult/wa form posts from the IdP; assertion extraction failed earlier and error was not surfaced; unit tests passing null; IdP returned an error response page instead of a token.","solutions":["Fix the upstream step that produced the null pair — validate the wresult response and log its failure before calling validateSignature.","Check that the IdP is actually returning a signed assertion (inspect the raw wresult).","Guard the call site: only invoke validateSignature when assertion extraction succeeded.","If this is a test, assert extraction succeeds before exercising validation."],"exampleFix":"// before\nboolean ok = helper.validateSignature(pair); // pair may be null\n// after\nif (pair == null || pair.getKey() == null) {\n    throw new IllegalStateException(\"Assertion extraction failed\");\n}\nboolean ok = helper.validateSignature(pair);","handlingStrategy":"type-guard","validationCode":"if (resultPair == null) {\n    LOGGER.error(\"Assertion extraction failed before signature validation\");\n    return;\n}","typeGuard":"boolean isValidateInput(Pair<Assertion, WsFederationConfiguration> p) {\n    return p != null && p.getKey() != null && p.getValue() != null;\n}","tryCatchPattern":null,"preventionTips":["Never call validateSignature directly with raw parse output; check extraction success first.","Return typed results (Optional) from parsing steps instead of null pairs.","Log the raw wresult when extraction fails to diagnose IdP issues."],"tags":["ws-federation","saml","signature","null-input"],"backgroundTag":"null-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}