{"record":{"id":"57c63e0de739b891","repo":"spring-projects/spring-security","slug":"failed-to-deserialize-payload","errorCode":null,"errorMessage":"Failed to deserialize payload","messagePattern":"Failed to deserialize payload","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java","lineNumber":91,"sourceCode":"\t\t@Override\n\t\tpublic XMLObject deserialize(InputStream serialized) {\n\t\t\ttry {\n\t\t\t\tParserPool parserPool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\t\tAssert.notNull(parserPool, \"A ParserPool must be configured\");\n\t\t\t\tDocument document = parserPool.parse(serialized);\n\t\t\t\tElement element = document.getDocumentElement();\n\t\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\t\tif (unmarshaller == null) {\n\t\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t\t}\n\t\t\t\treturn unmarshaller.unmarshall(element);\n\t\t\t}\n\t\t\tcatch (Saml2Exception ex) {\n\t\t\t\tthrow ex;\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":73,"sourceCodeEnd":98,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java#L73-L98","documentation":"This catch-all wraps any non-Saml2Exception thrown while deserializing the metadata payload (XML parse errors, IO failures, unmarshalling problems) into a Saml2Exception with the message 'Failed to deserialize payload' and the original as cause. It means the metadata bytes could not be turned into an OpenSAML XMLObject.","triggerScenarios":"Calling RelyingPartyRegistrations.fromMetadata/collectionFromMetadata with a stream containing malformed XML (syntax errors, encoding mismatch, truncated document) — any Exception other than CertificateException-shaped Saml2Exceptions from the inner path.","commonSituations":"Metadata file truncated by a partial download; BOM/encoding issues (declared UTF-8 but file is UTF-16); XML not well-formed after manual edits; InputStream already consumed by a previous read.","solutions":["Validate the metadata XML with a parser (xmllint) to find syntax/encoding errors","Re-download the metadata in full and compare sizes/checksums to rule out truncation","Ensure the InputStream is fresh and positioned at 0 when passed to fromMetadata","Check the cause chain (Saml2Exception#getCause) for the concrete parser error and fix it"],"exampleFix":"// before: reusing a consumed stream\nInputStream in = metadataStream();\nvalidate(in); fromMetadata(in); // stream exhausted\n// after: re-open or buffer first\nbyte[] bytes = metadataStream().readAllBytes();\nvalidate(new ByteArrayInputStream(bytes));\nRelyingPartyRegistration r = RelyingPartyRegistrations.fromMetadata(new ByteArrayInputStream(bytes));","handlingStrategy":"try-catch","validationCode":"// Well-formedness pre-check before handing stream to the library\nDocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();\ndb.parse(new ByteArrayInputStream(metadataBytes)); // throws SAXException on bad XML","typeGuard":null,"tryCatchPattern":"try {\n    return RelyingPartyRegistrations.fromMetadata(in);\n} catch (Saml2Exception ex) {\n    throw new IllegalStateException(\"Metadata could not be parsed: \" + ex.getCause(), ex);\n}","preventionTips":["Always inspect Saml2Exception.getCause() — the generic message hides XML parser detail","Validate metadata with xmllint before import","Read the payload fully into a byte[] first so streams aren't double-consumed"],"tags":["saml2","xml","deserialization","metadata"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}