{"record":{"id":"b68c84ea3c5c376c","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-marshallingexception-durin","errorCode":null,"errorMessage":"Saml2Exception wrapping MarshallingException during serialization","messagePattern":"Saml2Exception wrapping MarshallingException during serialization","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java","lineNumber":172,"sourceCode":"\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}\n\t\tcatch (MarshallingException ex) {\n\t\t\tthrow new Saml2Exception(ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(Element element) {\n\t\treturn new OpenSaml5SerializationConfigurer(element);\n\t}\n\n\t@Override\n\tpublic OpenSaml5SignatureConfigurer withSigningKeys(Collection<Saml2X509Credential> credentials) {\n\t\treturn new OpenSaml5SignatureConfigurer(credentials);\n\t}\n\n\t@Override\n\tpublic OpenSaml5VerificationConfigurer withVerificationKeys(Collection<Saml2X509Credential> credentials) {\n\t\treturn new OpenSaml5VerificationConfigurer(credentials);\n\t}\n","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java#L154-L190","documentation":"OpenSaml5Template.serialize(XMLObject) marshals the object to DOM via an OpenSAML Marshaller; any MarshallingException thrown during that operation is rethrown as a Saml2Exception with the original cause. It signals OpenSAML could not convert the in-memory XMLObject into its DOM representation.","triggerScenarios":"template.serialize(xmlObject) when marshall(object) fails — e.g. the object contains elements whose marshaller is missing, namespace conflicts, or an object tree in an inconsistent state (required child with no value, invalid QName).","commonSituations":"Serializing a hand-built XMLObject missing mandatory structure; registry misconfiguration so the element's marshaller is absent (in that case the preceding Assert.notNull throws instead); OpenSAML version mismatch producing inconsistent marshaller registries.","solutions":["Check ex.getCause()/stack trace for the underlying MarshallingException reason and fix the XMLObject content","Ensure the XMLObject was fully built via template.build()/proper builders, not partially constructed","Verify opensaml-saml-impl is present and OpenSAML is initialized so marshallers are registered","Confirm all required child attributes/elements are set before serialization"],"exampleFix":"// before\nResponse r = (Response) XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(Response.DEFAULT_ELEMENT_NAME).buildObject(Response.DEFAULT_ELEMENT_NAME);\n// after (use the template so builders/marshallers are guaranteed initialized)\nResponse r = template.build(Response.DEFAULT_ELEMENT_NAME);\nr.setID(\"_id\");\nString xml = template.serialize(r).prettyPrint();","handlingStrategy":"try-catch","validationCode":"Assert.notNull(XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object),\n    \"No marshaller for \" + object.getElementQName());","typeGuard":null,"tryCatchPattern":"try {\n    return template.serialize(object).prettyPrint();\n} catch (Saml2Exception ex) {\n    logger.warn(\"Marshalling failed for \" + object.getElementQName(), ex);\n    throw ex;\n}","preventionTips":["Build objects via template.build() so builders/marshallers are registered and consistent","Fully populate required attributes/children before serializing","Avoid mixing OpenSAML versions that produce inconsistent marshaller registries"],"tags":["saml2","opensaml","serialization","marshalling"],"backgroundTag":"json-marshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}