{"record":{"id":"18c105fc830d34ad","repo":"spring-projects/spring-security","slug":"this-converter-cannot-write-a-relyingpartyregistra","errorCode":null,"errorMessage":"This converter cannot write a RelyingPartyRegistration.Builder","messagePattern":"This converter cannot write a RelyingPartyRegistration\\.Builder","errorType":"http","errorClass":"HttpMessageNotWritableException","httpStatus":500,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlRelyingPartyRegistrationBuilderHttpMessageConverter.java","lineNumber":91,"sourceCode":"\tpublic boolean canWrite(Class<?> clazz, @Nullable MediaType mediaType) {\n\t\treturn false;\n\t}\n\n\t@Override\n\tpublic List<MediaType> getSupportedMediaTypes() {\n\t\treturn Arrays.asList(MediaType.APPLICATION_XML, MediaType.TEXT_XML);\n\t}\n\n\t@Override\n\tpublic RelyingPartyRegistration.Builder read(Class<? extends RelyingPartyRegistration.Builder> clazz,\n\t\t\tHttpInputMessage inputMessage) throws IOException, HttpMessageNotReadableException {\n\t\treturn RelyingPartyRegistrations.fromMetadata(inputMessage.getBody());\n\t}\n\n\t@Override\n\tpublic void write(RelyingPartyRegistration.Builder builder, @Nullable MediaType contentType,\n\t\t\tHttpOutputMessage outputMessage) throws HttpMessageNotWritableException {\n\t\tthrow new HttpMessageNotWritableException(\"This converter cannot write a RelyingPartyRegistration.Builder\");\n\t}\n\n}\n","sourceCodeStart":73,"sourceCodeEnd":95,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlRelyingPartyRegistrationBuilderHttpMessageConverter.java#L73-L95","documentation":"OpenSamlRelyingPartyRegistrationBuilderHttpMessageConverter only supports reading (converting metadata bytes into a RelyingPartyRegistration.Builder). Its write operation is intentionally unimplemented and always throws HttpMessageNotWritableException. If Spring MVC tries to serialize a RelyingPartyRegistration.Builder as an HTTP response body, this error occurs.","triggerScenarios":"Returning a RelyingPartyRegistration.Builder (or a type resolving to this converter) from a @RestController method, or calling converter.write(...) directly; HttpMessageNotWritableException thrown from write().","commonSituations":"Controller accidentally returns the Builder instead of a built RelyingPartyRegistration or a DTO; developer assumes the converter is bidirectional; misconfigured message converters pick this converter for the response.","solutions":["Call .build() on the RelyingPartyRegistration.Builder and return the RelyingPartyRegistration (or a DTO/metadata view) instead","If you need to emit SP metadata, use OpenSaml metadata generation endpoints (e.g. spring.security saml metadata filter) rather than this converter","Return a different response representation (Map, ResponseEntity<String>) so this converter isn't selected"],"exampleFix":"// before\n@GetMapping(\"/registration\")\npublic RelyingPartyRegistration.Builder registration() { return builder; }\n// after\n@GetMapping(\"/registration\")\npublic RelyingPartyRegistration registration() { return builder.build(); }","handlingStrategy":"type-guard","validationCode":"Object body = controllerReturnValue;\nif (body instanceof RelyingPartyRegistration.Builder) {\n    throw new IllegalStateException(\"Return RelyingPartyRegistration, not its Builder\");\n}","typeGuard":"boolean isWritable(Object body) {\n    return !(body instanceof RelyingPartyRegistration.Builder);\n}","tryCatchPattern":"// Avoid at runtime by design; if writing a generic handler:\ntry {\n    converter.write(builder, contentType, outputMessage);\n} catch (HttpMessageNotWritableException ex) {\n    throw new UnsupportedOperationException(\"Read-only converter; build the registration first\", ex);\n}","preventionTips":["Never return RelyingPartyRegistration.Builder from controllers; always .build() first","Remember this converter is read-only (metadata -> Builder)","Review @RequestMapping return types for accidental Builder leaks"],"tags":["http-message-converter","saml2","unsupported-operation","spring-mvc"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}