{"record":{"id":"c1ba6643f58e44a6","repo":"spring-projects/spring-security","slug":"unsupported-element-type","errorCode":null,"errorMessage":"Unsupported element type: ","messagePattern":"Unsupported element type: ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java","lineNumber":62,"sourceCode":"\t}\n\n\tstatic OpenSamlDeserializer resolveDeserializer() {\n\t\treturn new OpenSaml5Deserializer();\n\t}\n\n\tprivate OpenSamlMetadataUtils() {\n\n\t}\n\n\tstatic Collection<EntityDescriptor> descriptors(InputStream metadata) {\n\t\tXMLObject object = saml.deserialize(metadata);\n\t\tif (object instanceof EntityDescriptor descriptor) {\n\t\t\treturn Collections.singleton(descriptor);\n\t\t}\n\t\tif (object instanceof EntitiesDescriptor descriptors) {\n\t\t\treturn descriptors.getEntityDescriptors();\n\t\t}\n\t\tthrow new Saml2Exception(\"Unsupported element type: \" + object.getClass().getName());\n\t}\n\n\tprivate interface OpenSamlDeserializer {\n\n\t\tXMLObject deserialize(InputStream serialized);\n\n\t}\n\n\tprivate static class OpenSaml5Deserializer implements OpenSamlDeserializer {\n\n\t\t@Override\n\t\tpublic XMLObject deserialize(InputStream serialized) {\n\t\t\ttry {\n\t\t\t\tParserPool parserPool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\t\tAssert.notNull(parserPool, \"A ParserPool must be configured\");\n\t\t\t\tDocument document = parserPool.parse(serialized);\n\t\t\t\tElement element = document.getDocumentElement();\n\t\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java#L44-L80","documentation":"OpenSamlMetadataUtils.descriptors only knows how to turn an XMLObject of type EntityDescriptor or EntitiesDescriptor into a collection of EntityDescriptors. Any other element type (e.g. a bare Assertion, AttributeQueryDescriptor, or an unmarshalled wrapper) triggers this Saml2Exception naming the offending class.","triggerScenarios":"Feeding RelyingPartyRegistrations.fromMetadata/collectionFromMetadata (via OpenSamlMetadataUtils) a SAML document whose root element is neither EntityDescriptor nor EntitiesDescriptor.","commonSituations":"Pointing fromMetadataLocation at the wrong endpoint (e.g. an IdP's SSO URL or a SOAP error document instead of the metadata URL); serving HTML or an XML error page at the metadata URL; passing a serialized SAML assertion by mistake.","solutions":["Verify the metadata URL/file actually returns <EntityDescriptor> or <EntitiesDescriptor> as the root (curl it and inspect the root tag)","Use the correct IdP metadata endpoint (often /saml/metadata or /Shibboleth.sso/Metadata) rather than the SSO endpoint","If the IdP only publishes federation (EntitiesDescriptor) aggregates, that is supported — but the error class name will tell you what was actually received; align your input accordingly"],"exampleFix":"// before\nRelyingPartyRegistration r = RelyingPartyRegistrations.fromMetadataLocation(\"https://idp.example.com/sso/SSO\"); // wrong endpoint\n// after\nRelyingPartyRegistration r = RelyingPartyRegistrations.fromMetadataLocation(\"https://idp.example.com/saml/metadata\"); // real metadata endpoint","handlingStrategy":"validation","validationCode":"byte[] body = fetch(metadataUrl);\nString root = rootElementName(body); // parse and read document element\nif (!root.equals(\"EntityDescriptor\") && !root.equals(\"EntitiesDescriptor\")) {\n    throw new IllegalArgumentException(\"Expected SAML metadata, got root element: \" + root);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return RelyingPartyRegistrations.collectionFromMetadata(in);\n} catch (Saml2Exception ex) {\n    if (ex.getMessage() != null && ex.getMessage().startsWith(\"Unsupported element type\")) {\n        throw new IllegalStateException(\"Metadata URL returned a non-metadata document — check the URL\", ex);\n    }\n    throw ex;\n}","preventionTips":["Verify the metadata URL serves EntityDescriptor/EntitiesDescriptor (curl and inspect the root)","Do not confuse SSO endpoints with metadata endpoints","Check for HTML login redirects or proxies rewriting responses"],"tags":["saml2","metadata","unsupported-element","spring-security"],"backgroundTag":"unexpected-response-shape","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}