{"record":{"id":"575a3ac2001e08a2","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-exception-while-initializi","errorCode":null,"errorMessage":"Saml2Exception wrapping exception while initializing metadata resolver and signature validation filter","messagePattern":"Saml2Exception wrapping exception while initializing metadata resolver and signature validation filter","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5AssertingPartyMetadataRepository.java","lineNumber":220,"sourceCode":"\t\tprivate ResourceBackedMetadataResolver resourceBackedMetadataResolver() {\n\t\t\tResource resource = this.resourceLoader.getResource(this.metadataLocation);\n\t\t\ttry {\n\t\t\t\tResourceBackedMetadataResolver metadataResolver = new ResourceBackedMetadataResolver(\n\t\t\t\t\t\tnew SpringResource(resource));\n\t\t\t\tif (this.verificationCredentials.isEmpty()) {\n\t\t\t\t\treturn metadataResolver;\n\t\t\t\t}\n\t\t\t\tSignatureTrustEngine engine = new ExplicitKeySignatureTrustEngine(\n\t\t\t\t\t\tnew CollectionCredentialResolver(this.verificationCredentials),\n\t\t\t\t\t\tDefaultSecurityConfigurationBootstrap.buildBasicInlineKeyInfoCredentialResolver());\n\t\t\t\tSignatureValidationFilter filter = new SignatureValidationFilter(engine);\n\t\t\t\tfilter.setRequireSignedRoot(true);\n\t\t\t\tmetadataResolver.setMetadataFilter(filter);\n\t\t\t\tfilter.initialize();\n\t\t\t\treturn metadataResolver;\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t}\n\t\t}\n\n\t\tprivate MetadataResolver initialize(ResourceBackedMetadataResolver metadataResolver) {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tmetadataResolver.setParserPool(pool);\n\t\t\treturn BaseOpenSamlAssertingPartyMetadataRepository.initialize(metadataResolver);\n\t\t}\n\n\t\tprivate static final class SpringResource implements net.shibboleth.shared.resource.Resource {\n\n\t\t\tprivate final Resource resource;\n\n\t\t\tSpringResource(Resource resource) {\n\t\t\t\tthis.resource = resource;\n\t\t\t}\n","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5AssertingPartyMetadataRepository.java#L202-L238","documentation":"resourceBackedMetadataResolver builds a ResourceBackedMetadataResolver plus a SignatureValidationFilter (requireSignedRoot) and initializes the filter; any exception in this setup is wrapped in Saml2Exception. Thrown because failing to initialize the metadata resolver/filter leaves the asserting-party metadata unusable and trust cannot be established.","triggerScenarios":"Calling OpenSaml5AssertingPartyMetadataRepository metadata construction where filter.initialize() or resolver setup throws: unreadable metadata Resource, invalid XML, unsigned metadata root when signature is required, or missing trusted signature-verification credentials.","commonSituations":"Metadata file/URL resource missing or not readable at startup; IDP metadata not signed while setRequireSignedRoot(true); metadata signature cannot be verified against provided credentials; malformed XML in the metadata resource; classpath vs filesystem resource mix-up.","solutions":["Verify the metadata Resource exists and is readable at the given location (classpath vs file path mix-ups are common).","Either provide the IDP's signing certificate as a trusted credential for the SignatureValidationFilter, or (only in controlled environments) relax requireSignedRoot(false).","Validate the metadata XML is well-formed (xmllint) before wiring it into the repository.","Inspect the wrapped exception cause for the precise initialization failure (parser pool, filter, or resolver)."],"exampleFix":"// before\nResource metadata = new ClassPathResource(\"idp-metadata.xml\"); // file absent -> init fails\n// after\nResource metadata = new FileSystemResource(\"/etc/saml/idp-metadata.xml\");\nAssert.state(metadata.exists(), \"IDP metadata file missing\");\nrepository = new OpenSaml5AssertingPartyMetadataRepository(metadata, credentials);","handlingStrategy":"validation","validationCode":"Assert.state(metadataResource.exists(), \"IDP metadata resource must exist and be readable\");\nAssert.notEmpty(trustedCredentials, \"signature validation requires trusted signing credentials\");","typeGuard":null,"tryCatchPattern":"try {\n    OpenSaml5AssertingPartyMetadataRepository repo =\n        new OpenSaml5AssertingPartyMetadataRepository(metadataResource, credentials);\n} catch (Saml2Exception ex) {\n    logger.error(\"Metadata resolver initialization failed: {}\", ex.getCause() != null ? ex.getCause().getMessage() : ex.getMessage());\n}","preventionTips":["Check metadata resource existence/readability (classpath vs filesystem) at startup.","Provide the IDP signing certificate for SignatureValidationFilter when requireSignedRoot is true.","Validate metadata XML well-formedness before wiring it into the repository."],"tags":["saml2","metadata","resolver-initialization","signature-validation","opensaml5"],"backgroundTag":"module-init-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}