{"record":{"id":"ff7e35a494f3f5c0","repo":"apereo/cas","slug":"saml2-attribute-query-profile-is-not-enabled","errorCode":null,"errorMessage":"SAML2 attribute query profile is not enabled","messagePattern":"SAML2 attribute query profile is not enabled","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/query/SamlIdPSaml2AttributeQueryProfileHandlerController.java","lineNumber":61,"sourceCode":"public class SamlIdPSaml2AttributeQueryProfileHandlerController extends AbstractSamlIdPProfileHandlerController {\n    public SamlIdPSaml2AttributeQueryProfileHandlerController(final SamlProfileHandlerConfigurationContext context) {\n        super(context);\n    }\n\n    /**\n     * Handle post request.\n     *\n     * @param response the response\n     * @param request  the request\n     * @throws Exception the exception\n     */\n    @PostMapping(path = SamlIdPConstants.ENDPOINT_SAML2_SOAP_ATTRIBUTE_QUERY)\n    @Operation(summary = \"Handle SAML2 SOAP Attribute Query Request\")\n    protected void handlePostRequest(final HttpServletResponse response,\n                                     final HttpServletRequest request) throws Exception {\n        val enabled = configurationContext.getCasProperties().getAuthn().getSamlIdp().getCore().isAttributeQueryProfileEnabled();\n        if (!enabled) {\n            LOGGER.warn(\"SAML2 attribute query profile is not enabled\");\n            response.setStatus(HttpStatus.SC_NOT_IMPLEMENTED);\n            return;\n        }\n\n        val ctx = decodeSoapRequest(request);\n        val query = (AttributeQuery) ctx.getMessage();\n        try {\n            val issuer = Objects.requireNonNull(query).getIssuer().getValue();\n            val registeredService = verifySamlRegisteredService(issuer, request);\n            val adaptor = getSamlMetadataFacadeFor(registeredService, query);\n            val facade = adaptor.orElseThrow(() -> UnauthorizedServiceException.denied(\"Cannot find metadata linked to %s\".formatted(issuer)));\n            verifyAuthenticationContextSignature(ctx, request, query, facade, registeredService);\n\n            val nameIdValue = determineNameIdForQuery(query, registeredService, facade);\n            val factory = (SamlAttributeQueryTicketFactory) getConfigurationContext().getTicketFactory()\n                .get(SamlAttributeQueryTicket.class);\n            val id = factory.createTicketIdFor(nameIdValue, facade.getEntityId());\n            LOGGER.debug(\"Created ticket id for attribute query [{}]\", id);","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/query/SamlIdPSaml2AttributeQueryProfileHandlerController.java#L43-L79","documentation":"The SAML2 SOAP Attribute Query profile endpoint was hit while the profile is disabled in CAS properties. The controller logs a warning and responds with HTTP 501 Not Implemented instead of processing the AttributeQuery, by design as a feature switch.","triggerScenarios":"A POST to ENDPOINT_SAML2_SOAP_ATTRIBUTE_QUERY where cas.authn.saml-idp.core.attribute-query-profile-enabled is false; handlePostRequest checks isAttributeQueryProfileEnabled() and short-circuits.","commonSituations":"SP sends SOAP AttributeQuery requests but the IdP was deployed with the profile left at its disabled default; config property missing from deployment; ops unaware the feature must be explicitly enabled.","solutions":["Set cas.authn.saml-idp.core.attribute-query-profile-enabled=true in CAS properties","Ensure the configuration change is applied to the running deployment (reload/refresh)","If the profile is not needed, have the SP stop sending AttributeQuery requests to this endpoint"],"exampleFix":"// before (application.properties)\n# (property absent, default false)\n// after\ncas.authn.saml-idp.core.attribute-query-profile-enabled=true","handlingStrategy":"validation","validationCode":"// Check the feature flag before sending an AttributeQuery\nboolean enabled = casProperties.getAuthn().getSamlIdp().getCore().isAttributeQueryProfileEnabled();\nif (!enabled) {\n    // endpoint will return 501; enable the property first\n}","typeGuard":null,"tryCatchPattern":"try {\n    sendAttributeQuery(soapRequest);\n} catch (HttpException e) {\n    if (e.getStatusCode() == 501) {\n        LOGGER.error(\"Attribute Query profile disabled on IdP; enable \"\n            + \"cas.authn.saml-idp.core.attribute-query-profile-enabled\");\n    }\n}","preventionTips":["Enable cas.authn.saml-idp.core.attribute-query-profile-enabled when SPs use the Attribute Query profile","Treat a 501 from this endpoint as a configuration gap, not a network fault","Coordinate the property change with SP owners during onboarding","Check deployment properties after upgrades that may reset overrides"],"tags":["saml","saml-idp","attribute-query","soap","configuration"],"backgroundTag":"feature-not-enabled","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}