{"record":{"id":"faf23d546cbcddcc","repo":"apereo/cas","slug":"missing-providerid","errorCode":null,"errorMessage":"Missing providerId","messagePattern":"Missing providerId","errorType":"exception","errorClass":"MessageDecodingException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java","lineNumber":172,"sourceCode":"                providerId, SAMLConstants.SAML2_POST_BINDING_URI);\n            val acs = facade.getAssertionConsumerService(SAMLConstants.SAML2_POST_BINDING_URI);\n            shire = Optional.ofNullable(acs)\n                .map(service -> StringUtils.isBlank(service.getResponseLocation())\n                    ? service.getLocation()\n                    : service.getResponseLocation()).orElse(null);\n        }\n        if (StringUtils.isBlank(shire)) {\n            LOGGER.warn(\"Unable to resolve service provider assertion consumer service URL for AuthnRequest construction for entityID: [{}]\", providerId);\n            throw new MessageDecodingException(\"Unable to resolve SP ACS URL for AuthnRequest construction\");\n        }\n        return shire;\n    }\n\n    protected String extractProviderId(final HttpServletRequest request) throws MessageDecodingException {\n        val providerId = request.getParameter(SamlIdPConstants.PROVIDER_ID);\n        if (StringUtils.isBlank(providerId)) {\n            LOGGER.warn(\"No providerId parameter given in unsolicited SSO authentication request.\");\n            throw new MessageDecodingException(\"Missing providerId\");\n        }\n        return providerId;\n    }\n}\n","sourceCodeStart":154,"sourceCodeEnd":177,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/SamlIdPInitiatedProfileHandlerController.java#L154-L177","documentation":"The IdP-initiated (unsolicited SSO) profile requires the providerId request parameter identifying the SP entityID. If the parameter is missing or blank, decoding cannot proceed and MessageDecodingException is thrown.","triggerScenarios":"Hitting /idp/profile/SAML2/Unsolicited/SSO (or similar) without providerId, or with providerId= empty, in the HTTP request.","commonSituations":"Hand-crafted or bookmarked SSO links missing the parameter; gateway/proxy stripping query parameters; integration docs followed incorrectly.","solutions":["Append providerId=<SP entityID> to the unsolicited SSO URL.","Fix templates/links that construct the IdP-initiated SSO URL.","Check reverse proxy configuration for query-string rewriting/stripping.","Confirm you are using the correct endpoint with the expected parameter name."],"exampleFix":"// before\n/cas/idp/profile/SAML2/Unsolicited/SSO?shire=https://sp/acs\n// after\n/cas/idp/profile/SAML2/Unsolicited/SSO?providerId=https://sp.example.org/metadata&shire=https://sp/acs","handlingStrategy":"validation","validationCode":"val providerId = request.getParameter(SamlIdPConstants.PROVIDER_ID);\nif (StringUtils.isBlank(providerId)) throw new IllegalStateException(\"providerId query parameter required for unsolicited SSO\");","typeGuard":null,"tryCatchPattern":"try {\n    return controller.handleUnsolicitedSsoRequest(request, response);\n} catch (MessageDecodingException e) {\n    response.sendError(400, \"providerId parameter is required\");\n}","preventionTips":["Validate unsolicited SSO URL templates: they must contain both providerId and shire.","Add integration tests that hit the endpoint with required parameters.","Check proxy/gateway configs preserve query strings.","Document the exact URL format for SP partners."],"tags":["saml","unsolicited-sso","missing-parameter","http-request"],"backgroundTag":"missing-required-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}