{"record":{"id":"5fc4c8f19eaaa8b1","repo":"spring-projects/spring-security","slug":"spring-security-does-not-support-opensaml-version-5fc4c8","errorCode":null,"errorMessage":"Spring Security does not support OpenSAML {Version.getVersion()}. Please use OpenSAML 5","messagePattern":"Spring Security does not support OpenSAML (.+?)\\. Please use OpenSAML 5","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/Saml2LogoutBeanDefinitionParserUtils.java","lineNumber":77,"sourceCode":"\t\tString relyingPartyRegistrationRepositoryRef = element\n\t\t\t.getAttribute(ATT_RELYING_PARTY_REGISTRATION_REPOSITORY_REF);\n\t\tif (StringUtils.hasText(relyingPartyRegistrationRepositoryRef)) {\n\t\t\treturn new RuntimeBeanReference(relyingPartyRegistrationRepositoryRef);\n\t\t}\n\t\treturn new RuntimeBeanReference(RelyingPartyRegistrationRepository.class);\n\t}\n\n\tstatic BeanMetadataElement getLogoutResponseResolver(Element element, BeanMetadataElement registrations) {\n\t\tString logoutResponseResolver = element.getAttribute(ATT_LOGOUT_RESPONSE_RESOLVER_REF);\n\t\tif (StringUtils.hasText(logoutResponseResolver)) {\n\t\t\treturn new RuntimeBeanReference(logoutResponseResolver);\n\t\t}\n\t\tif (USE_OPENSAML_5) {\n\t\t\treturn BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5LogoutResponseResolver.class)\n\t\t\t\t.addConstructorArgValue(registrations)\n\t\t\t\t.getBeanDefinition();\n\t\t}\n\t\tthrow new IllegalArgumentException(\n\t\t\t\t\"Spring Security does not support OpenSAML \" + Version.getVersion() + \". Please use OpenSAML 5\");\n\t}\n\n\tstatic BeanMetadataElement getLogoutRequestValidator(Element element) {\n\t\tString logoutRequestValidator = element.getAttribute(ATT_LOGOUT_REQUEST_VALIDATOR_REF);\n\t\tif (StringUtils.hasText(logoutRequestValidator)) {\n\t\t\treturn new RuntimeBeanReference(logoutRequestValidator);\n\t\t}\n\t\tif (USE_OPENSAML_5) {\n\t\t\treturn BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5LogoutRequestValidator.class).getBeanDefinition();\n\t\t}\n\t\tthrow new IllegalArgumentException(\n\t\t\t\t\"Spring Security does not support OpenSAML \" + Version.getVersion() + \". Please use OpenSAML 5\");\n\t}\n\n\tstatic BeanMetadataElement getLogoutResponseValidator(Element element) {\n\t\tString logoutResponseValidator = element.getAttribute(ATT_LOGOUT_RESPONSE_VALIDATOR_REF);\n\t\tif (StringUtils.hasText(logoutResponseValidator)) {","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/Saml2LogoutBeanDefinitionParserUtils.java#L59-L95","documentation":"Saml2LogoutBeanDefinitionParserUtils.getLogoutResponseResolver creates the default OpenSaml5LogoutResponseResolver for <saml2-logout>. Spring Security requires OpenSAML 5; any other version triggers IllegalArgumentException reporting Version.getVersion() (Saml2LogoutBeanDefinitionParserUtils.java:77).","triggerScenarios":"Parsing <saml2-logout> XML config without a logout-response-validator-ref while the classpath has OpenSAML != 5, so getLogoutResponseResolver reaches the throw instead of building OpenSaml5LogoutResponseResolver.","commonSituations":"Apps with OpenSAML 4 from legacy SAML integration enabling saml2-logout; mismatched OpenSAML module versions in the dependency tree.","solutions":["Upgrade OpenSAML to 5.x across all opensaml-* modules.","Exclude or re-pin transitive OpenSAML 4 dependencies.","Provide a custom logout-response-resolver-ref to bypass the default factory (only if the custom resolver itself is OpenSAML-version compatible)."],"exampleFix":"// before\n<dependency-management><dependency><groupId>org.opensaml</groupId><artifactId>opensaml-core</artifactId><version>4.x</version></dependency></dependency-management>\n// after\n<dependency-management><dependency><groupId>org.opensaml</groupId><artifactId>opensaml-core</artifactId><version>5.1.0</version></dependency></dependency-management>","handlingStrategy":"validation","validationCode":"if (!org.opensaml.core.Version.getVersion().startsWith(\"5.\")) { throw new IllegalStateException(\"OpenSAML 5 required for <saml2-logout>\"); }","typeGuard":null,"tryCatchPattern":"try { ctx.refresh(); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"OpenSAML\")) { throw new ConfigurationException(\"Upgrade OpenSAML to 5.x for saml2-logout\"); } throw e; }","preventionTips":["Standardize OpenSAML 5.x across all modules before enabling saml2-logout","Run mvn dependency:tree and grep for opensaml-core version","Consider explicit -ref attributes for logout resolvers/validators if pinned to older OpenSAML"],"tags":["spring-security","saml","opensaml","saml-logout","version-incompatibility"],"backgroundTag":"unsupported-platform","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}