{"record":{"id":"2de305dc0ad5aa5b","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-2de305","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":500,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/internal/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/internal/OpenSaml5Template.java#L134-L170","documentation":"OpenSaml5Template.deserialize parses the serialized XML and asks the OpenSAML UnmarshallerFactory for an Unmarshaller matching the root element. When OpenSAML has no unmarshaller registered for that element's QName, the template throws Saml2Exception('Unsupported element of type <tagName>') — the payload is not a SAML element OpenSaml5 knows how to unmarshal.","triggerScenarios":"Calling deserialize(String/InputStream) with XML whose document element is not a registered OpenSAML type (wrong namespace, misspelled element, non-SAML XML, or an encrypted/asserted element where a plain one is expected).","commonSituations":"Sending non-SAML or wrapped XML to a SAML processing endpoint; version drift where a custom/vendor extension element has no unmarshaller registered; forgetting to initialize the OpenSAML bootstrap so provider registries are empty; feeding a signed response envelope instead of the expected artifact/LogoutRequest element.","solutions":["Inspect the serialized payload's root element namespace/tag and confirm it is a valid SAML element in the core protocol namespace.","Ensure OpenSAML initialization ran (OpenSamlInitializationService.initialize()) so unmarshaller factories are populated.","If you use custom SAML extension elements, register their unmarshallers with XMLObjectProviderRegistrySupport before deserializing.","Check that you are not decrypting/peeling the wrong layer (e.g. passing an EncryptedAssertion instead of the decrypted Assertion)."],"exampleFix":"// before\nclass MyInit { /* no bootstrap */ }\n// after\n@Configuration\nclass SamlInit {\n    @PostConstruct\n    void init() {\n        OpenSamlInitializationService.initialize();\n    }\n}","handlingStrategy":"try-catch","validationCode":"Document doc = parseLoosely(serialized);\nString ns = doc.getDocumentElement().getNamespaceURI();\nif (!\"urn:oasis:names:tc:SAML:2.0:protocol\".equals(ns)\n        && !\"urn:oasis:names:tc:SAML:2.0:assertion\".equals(ns)) {\n    throw new IllegalArgumentException(\"Not a SAML 2.0 element: \" + doc.getDocumentElement().getTagName());\n}","typeGuard":null,"tryCatchPattern":"try {\n    return template.deserialize(serialized);\n} catch (Saml2Exception ex) {\n    log.warn(\"Unsupported SAML element: {}\", ex.getMessage());\n    throw new Saml2ErrorStatusException(HttpStatus.BAD_REQUEST, ex);\n}","preventionTips":["Always run OpenSamlInitializationService.initialize() at application startup.","Log the raw payload (at debug) to confirm the root element before deserializing.","Register unmarshallers for any vendor SAML extensions you accept.","Keep OpenSAML version aligned across dependencies to avoid registry gaps."],"tags":["saml2","opensaml","xml-deserialization"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}