{"record":{"id":"c945b65d3b62eed2","repo":"twentyhq/twenty","slug":"x509data-element-is-missing","errorCode":null,"errorMessage":"X509Data element is missing","messagePattern":"X509Data element is missing","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts","lineNumber":88,"sourceCode":"      throw new Error('File is not valid XML');\n    }\n\n    const entityDescriptor = getByPrefixAndKey(xmlDoc, 'EntityDescriptor');\n    if (!entityDescriptor)\n      throw new Error('EntityDescriptor element is missing');\n\n    const IDPSSODescriptor = getByPrefixAndKey(xmlDoc, 'IDPSSODescriptor');\n    if (!IDPSSODescriptor)\n      throw new Error('IDPSSODescriptor element is missing');\n\n    const keyDescriptors = getByPrefixAndKey(IDPSSODescriptor, 'KeyDescriptor');\n    if (!keyDescriptors) throw new Error('KeyDescriptor element is missing');\n\n    const keyInfo = getByPrefixAndKey(keyDescriptors, 'KeyInfo');\n    if (!keyInfo) throw new Error('KeyInfo element is missing');\n\n    const x509Data = getByPrefixAndKey(keyInfo, 'X509Data');\n    if (!x509Data) throw new Error('X509Data element is missing');\n\n    const x509Certificate = getByPrefixAndKey(\n      x509Data,\n      'X509Certificate',\n    )?.textContent?.trim();\n    if (!x509Certificate)\n      throw new Error('X509Certificate is missing or empty');\n\n    const singleSignOnServices = getAllByPrefixAndKey(\n      IDPSSODescriptor,\n      'SingleSignOnService',\n    ).map((service) => ({\n      binding: service.getAttribute('Binding'),\n      location: service.getAttribute('Location'),\n    }));\n\n    // Prefer HTTP-Redirect (the default authnRequestBinding on the SP side),\n    // fall back to HTTP-POST since both are valid SAML 2.0 bindings and many","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/twentyhq/twenty/blob/1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6/packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts#L70-L106","documentation":"Thrown when <KeyInfo> was found but contains no <X509Data> sub-element. X509Data is the specific XMLDSig container that wraps the <X509Certificate>; the parser does not accept alternative key representations like RSAKeyValue or KeyValue.","triggerScenarios":"KeyInfo holds a <KeyValue>/<RSAKeyValue> instead of <X509Data>, or X509Data uses an unrecognized namespace prefix. IdP publishes a raw public key rather than an X.509 certificate.","commonSituations":"IdP configured to emit raw RSA keys. Metadata produced by a non-standard SAML library. Namespace prefix on X509Data is not in the md/ns0/ns2/dsig/ds allowlist.","solutions":["Open the XML and confirm <X509Data> exists inside <KeyInfo>.","If the IdP only publishes RSAKeyValue, reconfigure the IdP to export the X.509 certificate form.","Verify the X509Data namespace prefix is one of md/ns0/ns2/dsig/ds, or extend allPrefix."],"exampleFix":"// before: <ds:KeyInfo><ds:KeyValue><ds:RSAKeyValue>...</ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo>\n// after:  <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIID...</ds:X509Certificate></ds:X509Data></ds:KeyInfo>","handlingStrategy":"validation","validationCode":"const hasX509Data = (xml: string): boolean => /<[^>]*X509Data[\\s\\S]*?<\\/[^>]*X509Data>/.test(xml) || /<[^>]*X509Data[^>]*\\/>/.test(xml) === false && /<[^>]*X509Data[\\s>]/.test(xml);","typeGuard":"const keyInfoHasX509 = (keyInfoEl: Element): boolean =>\n  ['md','ns0','ns2','dsig','ds',''].some((p) =>\n    keyInfoEl.getElementsByTagName(p ? `${p}:X509Data` : 'X509Data').length > 0);","tryCatchPattern":"const res = parseSAMLMetadataFromXMLFile(xml);\nif (!res.success && res.reason.includes('X509Data')) {\n  notifyUser('IdP metadata must publish an X.509 certificate, not a raw public key');\n  return;\n}","preventionTips":["Prefer IdPs that export X.509 certs; if the IdP only emits RSAKeyValue, reconfigure it.","Add a pre-upload lint that greps for X509Data inside KeyInfo."],"tags":["saml","sso","xml","enterprise","validation"],"backgroundTag":null,"analyzedSha":"1f5dd2bbd2a8da3419c8cfd52dd545c0024df1a6","analyzedAt":"2026-08-12T15:37:27.593Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}