{"record":{"id":"fa68f585710236e3","repo":"apereo/cas","slug":"assertion-will-skip-assigning-generating-a-nameid","errorCode":null,"errorMessage":"Assertion will skip assigning/generating a nameId based on service [{}]","messagePattern":"Assertion will skip assigning/generating a nameId based on service \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/subject/SamlProfileSamlSubjectBuilder.java","lineNumber":93,"sourceCode":"        val finalSubjectNameId = encryptNameIdIfNecessary(subjectNameId, context);\n        val finalSubjectConfigNameId = encryptNameIdIfNecessary(subjectConfNameId, context);\n\n        val entityId = casProperties.getAuthn().getSamlIdp().getCore().getEntityId();\n        val subjectConfirmation = newSubjectConfirmation(\n            registeredService.isSkipGeneratingSubjectConfirmationRecipient() ? null : location,\n            notOnOrAfter,\n            getInResponseTo(context.getSamlRequest(), entityId, registeredService.isSkipGeneratingSubjectConfirmationInResponseTo()),\n            registeredService.isSkipGeneratingSubjectConfirmationNotBefore() ? null : ZonedDateTime.now(ZoneOffset.UTC),\n            registeredService.isSkipGeneratingSubjectConfirmationAddress() ? null : InetAddressUtils.getByName(location));\n        \n        val subject = newSubject(finalSubjectNameId, finalSubjectConfigNameId, subjectConfirmation);\n        LOGGER.debug(\"Created SAML subject [{}]\", subject);\n        return subject;\n    }\n\n    private SAMLObject getNameIdForService(final SamlProfileBuilderContext context) throws Exception {\n        if (context.getRegisteredService().isSkipGeneratingAssertionNameId()) {\n            LOGGER.warn(\"Assertion will skip assigning/generating a nameId based on service [{}]\", context.getRegisteredService());\n            return null;\n        }\n        return ssoPostProfileSamlNameIdBuilder.build(context);\n    }\n\n    private SAMLObject encryptNameIdIfNecessary(final SAMLObject subjectNameId,\n                                                final SamlProfileBuilderContext context) {\n        if (!(subjectNameId instanceof EncryptedID)\n            && subjectNameId instanceof final NameID nameId\n            && NameIDType.ENCRYPTED.equalsIgnoreCase(nameId.getFormat())) {\n            return samlObjectEncrypter.encode(nameId, context.getRegisteredService(), context.getAdaptor());\n        }\n        return subjectNameId;\n    }\n}\n","sourceCodeStart":75,"sourceCodeEnd":109,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/subject/SamlProfileSamlSubjectBuilder.java#L75-L109","documentation":"The registered SAML service is configured to skip generating an assertion NameID, so the subject builder deliberately returns null instead of invoking the NameID builder. This is an expected, warning-level outcome used for SPs that do not require a <NameID> in the assertion subject (typically relying on SubjectConfirmation only).","triggerScenarios":"subjectNameId/subjectConfNameId -> getNameIdForService sees context.getRegisteredService().isSkipGeneratingAssertionNameId() == true and returns null without building a NameID.","commonSituations":"Service definition has skipGeneratingAssertionNameId enabled accidentally; SP actually requires a NameID but admin enabled the flag; copying service config templates that set the flag.","solutions":["Set skipGeneratingAssertionNameId = false in the registered SAML service if the SP expects a NameID","Confirm the SP tolerates assertions without a NameID before leaving the flag enabled","Review the service definition configuration in the management console or JSON registry for the flag"],"exampleFix":"// before (service JSON)\n\"skipGeneratingAssertionNameId\": true\n// after\n\"skipGeneratingAssertionNameId\": false","handlingStrategy":"validation","validationCode":"// Check the flag before expecting a NameID in the assertion\nif (registeredService.isSkipGeneratingAssertionNameId()) {\n    LOGGER.info(\"SP [{}] will receive assertions without a NameID\", registeredService.getServiceId());\n}","typeGuard":null,"tryCatchPattern":"try {\n    val nameId = getNameIdForService(context);\n    if (nameId == null) {\n        // expected when skipGeneratingAssertionNameId is enabled\n        LOGGER.debug(\"NameID intentionally omitted\");\n    }\n} catch (Exception e) {\n    LOGGER.error(\"Subject building failed\", e);\n}","preventionTips":["Only set skipGeneratingAssertionNameId for SPs verified to work without a NameID","Document the flag's effect in your service registry notes","Re-test SP integrations after toggling the flag","Audit service definitions for unexpected flag values"],"tags":["saml","saml-idp","nameid","service-config"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}