{"record":{"id":"066f50869d78e510","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-066f50","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/OpenSaml5Template.java#L134-L170","documentation":"OpenSaml5Template.deserialize() parses the XML string and asks OpenSAML's UnmarshallerFactory for an unmarshaller for the root element. If none is registered for that element's QName/tagName, Spring Security throws this Saml2Exception because it cannot convert the raw DOM element into an OpenSAML XMLObject.","triggerScenarios":"Calling OpenSaml5Template.deserialize(String) whose document root element has no registered OpenSAML unmarshaller — factory.getUnmarshaller(element) returns null (message includes the root element's tag name).","commonSituations":"Deserializing non-SAML or malformed XML (wrong root element, HTML error page, SOAP envelope instead of SAML message); feeding a truncated/modified SAML response; registry not initialized before parsing; wrong namespace on the root element (e.g. stripped or rewritten by a proxy).","solutions":["Ensure the input is a valid SAML document whose root element is a SAML protocol element (e.g. saml2p:Response, saml2p:LogoutResponse) in the correct namespace.","Call OpenSamlInitializationService.initialize() before deserializing so default unmarshallers are registered.","Validate/inspect the serialized payload's root tag name (reported in the message) to find what is actually being fed in — often an upstream error page or proxy-rewritten XML.","Check classpath for mixed OpenSAML 4/5 jars and remove the old ones so unmarshallers register in the active registry."],"exampleFix":"// before\nString body = new String(responseBytes); // may be an HTML error page\nResponse r = template.deserialize(body);\n\n// after\nOpenSamlInitializationService.initialize();\nif (!body.contains(\"urn:oasis:names:tc:SAML:2.0:protocol\")) {\n    throw new Saml2Exception(\"Not a SAML protocol document: \" + body.substring(0, Math.min(80, body.length())));\n}\nResponse r = template.deserialize(body);","handlingStrategy":"validation","validationCode":"if (!serialized.trim().startsWith(\"<\") || !serialized.contains(\"urn:oasis:names:tc:SAML\")) {\n    throw new IllegalArgumentException(\"Payload is not a SAML XML document\");\n}","typeGuard":null,"tryCatchPattern":"try { return template.deserialize(serialized); } catch (Saml2Exception ex) { log.warn(\"Unsupported SAML root element: {}\", ex.getMessage()); throw new InvalidSamlPayloadException(ex); }","preventionTips":["Inspect the root tag name reported in the message when debugging","Decode Base64/URL encodings before deserializing","Reject non-XML payloads (HTML error pages) early"],"tags":["saml","opensaml","xml-deserialization","spring-security"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}