{"record":{"id":"c8dd0e7918e69cf0","repo":"twentyhq/twenty","slug":"idpssodescriptor-element-is-missing","errorCode":null,"errorMessage":"IDPSSODescriptor element is missing","messagePattern":"IDPSSODescriptor element is missing","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"warning","filePath":"packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts","lineNumber":79,"sourceCode":"export const parseSAMLMetadataFromXMLFile = (\n  xmlString: string,\n):\n  | { success: true; data: z.infer<typeof validator> }\n  | { success: false; reason: string } => {\n  try {\n    const parser = new DOMParser();\n    const xmlDoc = parser.parseFromString(xmlString, 'application/xml');\n    if (xmlDoc.getElementsByTagName('parsererror').length > 0) {\n      throw new Error('File is not valid XML');\n    }\n\n    const entityDescriptor = getByPrefixAndKey(xmlDoc, 'EntityDescriptor');\n    if (!entityDescriptor)\n      throw new Error('EntityDescriptor element is missing');\n\n    const IDPSSODescriptor = getByPrefixAndKey(xmlDoc, 'IDPSSODescriptor');\n    if (!IDPSSODescriptor)\n      throw new Error('IDPSSODescriptor element is missing');\n\n    const keyDescriptors = getByPrefixAndKey(IDPSSODescriptor, 'KeyDescriptor');\n    if (!keyDescriptors) throw new Error('KeyDescriptor element is missing');\n\n    const keyInfo = getByPrefixAndKey(keyDescriptors, 'KeyInfo');\n    if (!keyInfo) throw new Error('KeyInfo element is missing');\n\n    const x509Data = getByPrefixAndKey(keyInfo, 'X509Data');\n    if (!x509Data) throw new Error('X509Data element is missing');\n\n    const x509Certificate = getByPrefixAndKey(\n      x509Data,\n      'X509Certificate',\n    )?.textContent?.trim();\n    if (!x509Certificate)\n      throw new Error('X509Certificate is missing or empty');\n\n    const singleSignOnServices = getAllByPrefixAndKey(","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/twentyhq/twenty/blob/1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6/packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts#L61-L97","documentation":"Thrown by parseSAMLMetadataFromXMLFile (parseSAMLMetadataFromXMLFile.ts:77-79) when EntityDescriptor exists but contains no IDPSSODescriptor element (searched across supported namespace prefixes and unprefixed). IDPSSODescriptor describes the IdP's SSO capabilities and is required to extract SingleSignOnService URLs and signing certificates. Caught at line 127 and returned as `{ success: false, reason: 'IDPSSODescriptor element is missing' }`.","triggerScenarios":"Uploaded XML has EntityDescriptor but no IDPSSODescriptor — e.g. metadata for a service provider (which uses SPSSODescriptor), an attribute authority (AttributeAuthorityDescriptor), or a SAML entity role other than IdP.","commonSituations":"Uploading SP metadata instead of IdP metadata; the IdP metadata file only contains AttributeAuthorityDescriptor; partial metadata export missing the role descriptor; metadata for a different federation role.","solutions":["Obtain IdP metadata that includes IDPSSODescriptor (not SP metadata).","Download metadata directly from the IdP's well-known URL (e.g. /idp/metadata/adapter).","Confirm with the IdP admin that the metadata describes the IdP role.","Inspect the XML to verify the role descriptor element name."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Pre-check for IDPSSODescriptor before parsing\nconst doc = new DOMParser().parseFromString(xmlString, 'application/xml');\nconst hasIdpSsoDescriptor =\n  ['md', 'ns0', 'ns2', 'dsig', 'ds', '']\n    .some((p) => doc.getElementsByTagName(p ? `${p}:IDPSSODescriptor` : 'IDPSSODescriptor').length > 0);\nif (!hasIdpSsoDescriptor) {\n  setFormError(t`Metadata must describe an Identity Provider (IDPSSODescriptor)`);\n}","typeGuard":"const hasIdpSsoDescriptor = (s: string): boolean => {\n  const doc = new DOMParser().parseFromString(s, 'application/xml');\n  return ['md', 'ns0', 'ns2', 'dsig', 'ds', '']\n    .some((p) => doc.getElementsByTagName(p ? `${p}:IDPSSODescriptor` : 'IDPSSODescriptor').length > 0);\n};","tryCatchPattern":"// Parser returns { success: false, reason } — handle accordingly\nconst result = parseSAMLMetadataFromXMLFile(xmlString);\nif (!result.success && result.reason === 'IDPSSODescriptor element is missing') {\n  setFormError(t`Upload IdP metadata (not SP metadata)`);\n}","preventionTips":["Upload IdP metadata, not SP metadata.","Confirm with the IdP admin that the metadata describes the IdP role.","Inspect the descriptor element name before uploading.","Download metadata from the IdP's well-known endpoint."],"tags":["frontend","saml","sso","xml","parsing","settings"],"backgroundTag":null,"analyzedSha":"1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6","analyzedAt":"2026-08-12T15:37:27.593Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}