{"record":{"id":"a9f2222c2483d1dc","repo":"spring-projects/spring-security","slug":"internal-validation-error","errorCode":"internal_validation_error","errorMessage":"internalValidationError(ex.getMessage())","messagePattern":"internalValidationError\\(ex\\.getMessage\\(\\)\\)","errorType":"error_code","errorClass":"Saml2AuthenticationException","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/BaseOpenSamlAuthenticationProvider.java","lineNumber":310,"sourceCode":"\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\ttry {\n\t\t\tSaml2AuthenticationToken token = (Saml2AuthenticationToken) authentication;\n\t\t\tString serializedResponse = token.getSaml2Response();\n\t\t\tResponse response = parseResponse(serializedResponse);\n\t\t\tprocess(token, response);\n\t\t\tAbstractAuthenticationToken authenticationResponse = this.responseAuthenticationConverter\n\t\t\t\t.convert(new ResponseToken(response, token));\n\t\t\tif (authenticationResponse != null) {\n\t\t\t\tauthenticationResponse.setDetails(authentication.getDetails());\n\t\t\t}\n\t\t\treturn authenticationResponse;\n\t\t}\n\t\tcatch (Saml2AuthenticationException ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2AuthenticationException(Saml2Error.internalValidationError(ex.getMessage()), ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<?> authentication) {\n\t\treturn Saml2AuthenticationToken.class.isAssignableFrom(authentication);\n\t}\n\n\tprivate Response parseResponse(String response) throws Saml2Exception, Saml2AuthenticationException {\n\t\ttry {\n\t\t\treturn this.saml.deserialize(response);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2AuthenticationException(Saml2Error.malformedResponseData(ex.getMessage()), ex);\n\t\t}\n\t}\n\n\tprivate void process(Saml2AuthenticationToken token, Response response) {","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/BaseOpenSamlAuthenticationProvider.java#L292-L328","documentation":"BaseOpenSamlAuthenticationProvider wraps any unexpected Exception raised during SAML response processing into a Saml2AuthenticationException with the internal_validation_error code. It is a catch-all for bugs or unexpected conditions (not standard SAML validation failures), preserving the original exception's message as the cause.","triggerScenarios":"Any non-Saml2AuthenticationException escaping the try block in authenticate(): e.g. NullPointerException from a misbuilt RelyingPartyRegistration, ClassCastException, or an OpenSAML library error during response evaluation. Standard validation failures instead use their specific error codes.","commonSituations":"Incomplete RelyingPartyRegistration configuration (missing metadata/IDP info) causing NPEs; incompatible OpenSAML initialization (missing OpenSAMLInitializationService call); version mismatches between Spring Security and OpenSAML; custom converters/validators throwing runtime exceptions.","solutions":["Read the wrapped cause (ex.getCause()) — the real fix targets it, not this wrapper","Verify RelyingPartyRegistration is fully configured (metadata, IDP entity ID, SSO URL, decryption/signing credentials)","Ensure OpenSAML is initialized (OpenSAMLInitializationService.initialize()) in your environment","Check that your Spring Security and OpenSAML versions are compatible; upgrade both together"],"exampleFix":"// before\nRelyingPartyRegistration reg = RelyingPartyRegistration.withRegistrationId(\"idp\").build(); // incomplete\n// after\nRelyingPartyRegistrations.fromMetadataLocation(\"https://idp/metadata\")\n    .registrationId(\"idp\")\n    .build();","handlingStrategy":"try-catch","validationCode":"Assert.notNull(registration.getMetadataLocation(), \"metadataLocation required\");\nAssert.hasText(registration.getEntityId(), \"entityId required\");\nAssert.notEmpty(registration.getAssertionConsumerServiceLocation() != null\n    ? List.of(registration.getAssertionConsumerServiceLocation()) : List.of(), \"ACS required\");\nOpenSAMLInitializationService.initialize();","typeGuard":null,"tryCatchPattern":"try {\n    Authentication result = provider.authenticate(token);\n} catch (Saml2AuthenticationException e) {\n    if (Saml2ErrorCodes.INTERNAL_VALIDATION_ERROR.equals(e.getError().getErrorCode())) {\n        logger.error(\"SAML internal error\", e.getCause()); // fix targets the cause\n        throw e;\n    }\n}","preventionTips":["Always initialize OpenSAML before use in standalone/custom setups","Build RelyingPartyRegistration via RelyingPartyRegistrations.fromMetadataLocation to avoid partial configs","Keep Spring Security and OpenSAML versions aligned","Log the cause chain — the internal_validation_error message is only a wrapper"],"tags":["saml2","spring-security","internal-error"],"backgroundTag":"internal-invariant-violation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}