{"record":{"id":"f017f68580f66598","repo":"apereo/cas","slug":"intermediate-requires-authority-hint-s","errorCode":null,"errorMessage":"Intermediate requires authority hint(s)","messagePattern":"Intermediate requires authority hint\\(s\\)","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java","lineNumber":85,"sourceCode":"        var issuer = oidcProperties.getCore().getIssuer();\n        val metadata = new JSONObject();\n        val authorityHints = oidcProperties.getFederation().getAuthorityHints().stream().map(EntityID::new).toList();\n        if (settings != null) {\n            if (role != OidcFederationRole.OPENID_PROVIDER) {\n                throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for OpenID Provider\");\n            }\n            issuer = settings.getIssuer();\n\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"OpenID provider requires authority hint(s)\");\n            }\n\n            val json = JSONValue.parse(settings.toJson());\n            metadata.put(EntityType.OPENID_PROVIDER.getValue(), json);\n\n        } else if (role == OidcFederationRole.INTERMEDIATE) {\n            if (authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Intermediate requires authority hint(s)\");\n            }\n\n        } else if (role == OidcFederationRole.TRUST_ANCHOR) {\n            if (!authorityHints.isEmpty()) {\n                throw new IllegalArgumentException(\"Trust anchor requires no authority hints\");\n            }\n\n        } else {\n            throw new IllegalArgumentException(\"Federation role [\" + role + \"] is not supported for Trust Anchor/Intermediate\");\n        }\n\n        val federationMetadata = buildMetadata(issuer);\n        metadata.put(EntityType.FEDERATION_ENTITY.getValue(), federationMetadata.toJSONObject());\n\n        return buildEntityStatement(issuer, issuer, metadata, null, authorityHints);\n    }\n}\n","sourceCodeStart":67,"sourceCodeEnd":103,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-federation/src/main/java/org/apereo/cas/oidc/federation/web/OidcWellKnownFederationEndpointController.java#L67-L103","documentation":"An Intermediate entity, like an OP, must reference at least one superior entity via authority hints. The controller throws this IllegalArgumentException when the role is INTERMEDIATE but cas.oidc.federation.authority-hints is empty.","triggerScenarios":"Deployment role set to INTERMEDIATE with no authority-hints configured while the well-known federation metadata is being built.","commonSituations":"Intermediate registered directly under a trust anchor but the anchor's entity ID never added to config; YAML list syntax error producing an empty list.","solutions":["Add the parent trust anchor (or superior intermediate) entity ID(s) to cas.oidc.federation.authority-hints","Verify the YAML/properties list actually parses to a non-empty collection (check indentation)","Change role to TRUST_ANCHOR only if the entity really has no superior"],"exampleFix":"// before\ncas.oidc.federation.role=INTERMEDIATE\n# no authority-hints\n// after\ncas.oidc.federation.role=INTERMEDIATE\ncas.oidc.federation.authority-hints=https://ta.example.org","handlingStrategy":"validation","validationCode":"if (role == OidcFederationRole.INTERMEDIATE && oidcProperties.getFederation().getAuthorityHints().isEmpty()) {\n    throw new IllegalStateException(\"Intermediate requires authority hints\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set the parent trust anchor entity ID for every intermediate","Verify YAML list indentation so hints parse non-empty"],"tags":["configuration","oidc-federation","authority-hints"],"backgroundTag":"missing-required-config-field","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}