{"record":{"id":"9c99dd4d1caf7fe3","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-marshallingexception-durin-9c99dd","errorCode":null,"errorMessage":"Saml2Exception wrapping MarshallingException during serialization","messagePattern":"Saml2Exception wrapping MarshallingException during serialization","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java","lineNumber":172,"sourceCode":"\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);\n\t}\n\n\t@Override\n\tpublic OpenSaml5SignatureConfigurer withSigningKeys(Collection<Saml2X509Credential> credentials) {\n\t\treturn new OpenSaml5SignatureConfigurer(credentials);\n\t}\n\n\t@Override\n\tpublic OpenSaml5VerificationConfigurer withVerificationKeys(Collection<Saml2X509Credential> credentials) {\n\t\treturn new OpenSaml5VerificationConfigurer(credentials);\n\t}\n","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java#L154-L190","documentation":"OpenSaml5Template.serialize(XMLObject) marshals the XMLObject to a DOM Element via OpenSAML's Marshaller; a MarshallingException is wrapped in Saml2Exception. This means the SAML object could not be serialized to XML, typically because the object is structurally invalid or in an inconsistent build state.","triggerScenarios":"Calling serialize(object) where marshaller.marshall(object) throws — e.g. the object was built manually without required attributes (like an ID on a SignableXMLObject), a marshalling rule violation, or no marshaller exists (caught earlier by Assert.notNull).","commonSituations":"Constructing XMLObjects by hand and missing required schema fields; reusing/marshalling an object whose DOM owner document conflicts; modifying an object after signing causing validator failures during marshall.","solutions":["Inspect the wrapped MarshallingException message for the specific schema/structure violation","Build objects via OpenSamlTemplate.build() so required fields (IDs, IssueInstant) are populated by default","Validate the object (schema validators) before marshalling","Create a fresh XMLObject instead of mutating/re-marshalling a previously marshalled instance"],"exampleFix":"// before\nResponse r = buildResponse();\nr.setID(null); // marshall requires an ID\nserialize(r); // MarshallingException\n// after\nResponse r = buildResponse(); // builder sets ID/IssueInstant defaults\nserialize(r);","handlingStrategy":"try-catch","validationCode":"Marshaller m = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\nif (m == null) throw new IllegalStateException(\"No marshaller for \" + object.getElementQName());\n// schema-validate the object before marshalling\nXMLObjectSupport.validate(object);","typeGuard":null,"tryCatchPattern":"try {\n    return template.serialize(object);\n} catch (Saml2Exception ex) {\n    if (ex.getCause() instanceof MarshallingException)\n        throw new IllegalStateException(\"SAML object could not be marshalled: \" + ex.getCause().getMessage(), ex);\n    throw ex;\n}","preventionTips":["Build XMLObjects via OpenSamlTemplate.build() so required fields are defaulted","Never mutate a signed/marshalled object before re-serializing","Schema-validate complex hand-built objects before marshalling"],"tags":["saml2","opensaml","serialize","marshalling","spring-security"],"backgroundTag":"xml-marshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}