{"record":{"id":"a6840940740d6489","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-a68409","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java#L134-L170","documentation":"The metadata-package copy of OpenSaml5Template.deserialize(): after parsing the XML it looks up an Unmarshaller for the document's root element and throws Saml2Exception when OpenSAML has no unmarshaller registered for that element type — the payload's root element is not a known OpenSAML XML type.","triggerScenarios":"Calling OpenSaml5Template.deserialize(String) on metadata/other XML whose root element namespace or name is not registered with OpenSAML — non-SAML XML (HTML error pages), unregistered extension namespaces, or deserializing before OpenSAML providers are initialized.","commonSituations":"A metadata endpoint behind a proxy returns an HTML error or login page; metadata extensions from namespaces whose OpenSAML module is missing; deserialize called at startup before OpenSAML initialization.","solutions":["Verify the metadata URL actually returns EntitiesDescriptor/EntityDescriptor XML — log the root tag on failure.","Initialize OpenSAML default providers (OpenSamlInitializationService.initialize()) before deserializing.","Add the OpenSAML module for any extension namespaces present in the metadata document.","Fetch metadata over a trusted endpoint and check Content-Type/first bytes before deserializing."],"exampleFix":"// before\nEntityDescriptor ed = template.deserialize(fetch(metadataUrl));\n// Saml2Exception: Unsupported element of type html (proxy returned error page)\n// after\nString body = fetch(metadataUrl);\nif (!body.contains(\"EntityDescriptor\")) {\n    throw new Saml2Exception(\"Metadata endpoint returned non-SAML content\");\n}\nEntityDescriptor ed = template.deserialize(body);","handlingStrategy":"validation","validationCode":"String body = fetch(metadataUrl);\nif (!body.trim().startsWith(\"<\") || !body.contains(\"EntityDescriptor\") && !body.contains(\"EntitiesDescriptor\")) {\n    throw new IllegalStateException(\"Metadata endpoint returned non-SAML content\");\n}","typeGuard":"static boolean isKnownSamlElement(Element root) {\n    return XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(root) != null;\n}","tryCatchPattern":"try {\n    EntityDescriptor ed = template.deserialize(body);\n} catch (Saml2Exception ex) {\n    throw new Saml2Exception(\"Metadata root element unsupported: check endpoint output and OpenSAML modules\", ex);\n}","preventionTips":["Check the metadata endpoint returns XML (not an HTML login/proxy error page) before deserializing.","Initialize OpenSAML providers before metadata processing.","Add modules for extension namespaces present in partner metadata.","Pin trusted metadata URLs with authentication to avoid error-page responses."],"tags":["saml2","opensaml","metadata","unmarshaller"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}