{"record":{"id":"8d3ea3be24a3b694","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-8d3ea3","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/OpenSaml5Template.java#L134-L170","documentation":"Same family as error 581, in the logout OpenSaml5Template: deserialize() throws this Saml2Exception when OpenSAML's UnmarshallerFactory has no unmarshaller for the parsed document's root element, so the logout XML cannot be converted to an XMLObject. The root element's tag name is included in the message.","triggerScenarios":"Calling logout OpenSaml5Template.deserialize(String) where the root element has no registered unmarshaller — e.g. the payload's root is not a SAML element.","commonSituations":"Deserializing a SLO message whose root was rewritten or stripped of its namespace by a gateway; feeding HTML/plain-text error bodies; uninitialized OpenSAML registry; wrong document passed (SAML Response instead of LogoutResponse).","solutions":["Check the tag name in the message and confirm the payload's root is the expected SAML protocol element with correct namespace (e.g. saml2p:LogoutRequest/LogoutResponse).","Run OpenSamlInitializationService.initialize() so default unmarshallers are registered.","Validate the raw payload before deserializing (well-formed XML, correct namespaces).","Ensure only OpenSAML 5 jars are on the classpath."],"exampleFix":"// before\nString body = errorPageFromIdp; // not SAML\nLogoutResponse lr = template.deserialize(body);\n\n// after\nOpenSamlInitializationService.initialize();\nAssert.isTrue(body.contains(\"urn:oasis:names:tc:SAML:2.0:protocol\"), \"payload is not a SAML protocol document\");\nLogoutResponse lr = template.deserialize(body);","handlingStrategy":"validation","validationCode":"if (!serialized.contains(\"urn:oasis:names:tc:SAML:2.0:protocol\")) {\n    throw new IllegalArgumentException(\"Payload root is not a SAML protocol element\");\n}","typeGuard":null,"tryCatchPattern":"try { return template.deserialize(serialized); } catch (Saml2Exception ex) { log.warn(\"Unsupported logout element: {}\", ex.getMessage()); throw new InvalidSamlPayloadException(ex); }","preventionTips":["Confirm the root element tag/namespace before deserializing SLO messages","Ensure OpenSAML init has run before first use","Reject HTML/plain-text error bodies from IdP before parsing"],"tags":["saml","opensaml","logout","deserialization","spring-security"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}