{"record":{"id":"cae5d5174fe10116","repo":"spring-projects/spring-security","slug":"spring-security-does-not-support-opensaml-version","errorCode":null,"errorMessage":"Spring Security does not support OpenSAML {Version.getVersion()}. Please use OpenSAML 5","messagePattern":"Spring Security does not support OpenSAML (.+?)\\. Please use OpenSAML 5","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParserUtils.java","lineNumber":93,"sourceCode":"\t\tString authenticationRequestContextResolver = element.getAttribute(ATT_AUTHENTICATION_REQUEST_RESOLVER_REF);\n\t\tif (StringUtils.hasText(authenticationRequestContextResolver)) {\n\t\t\treturn new RuntimeBeanReference(authenticationRequestContextResolver);\n\t\t}\n\t\treturn null;\n\t}\n\n\tstatic BeanMetadataElement createDefaultAuthenticationRequestResolver(\n\t\t\tBeanMetadataElement relyingPartyRegistrationRepository) {\n\t\tBeanMetadataElement defaultRelyingPartyRegistrationResolver = BeanDefinitionBuilder\n\t\t\t.rootBeanDefinition(DefaultRelyingPartyRegistrationResolver.class)\n\t\t\t.addConstructorArgValue(relyingPartyRegistrationRepository)\n\t\t\t.getBeanDefinition();\n\t\tif (USE_OPENSAML_5) {\n\t\t\treturn BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5AuthenticationRequestResolver.class)\n\t\t\t\t.addConstructorArgValue(defaultRelyingPartyRegistrationResolver)\n\t\t\t\t.getBeanDefinition();\n\t\t}\n\t\tthrow new IllegalArgumentException(\n\t\t\t\t\"Spring Security does not support OpenSAML \" + Version.getVersion() + \". Please use OpenSAML 5\");\n\t}\n\n\tstatic BeanDefinition createAuthenticationProvider() {\n\t\tif (USE_OPENSAML_5) {\n\t\t\treturn BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5AuthenticationProvider.class).getBeanDefinition();\n\t\t}\n\t\tthrow new IllegalArgumentException(\n\t\t\t\t\"Spring Security does not support OpenSAML \" + Version.getVersion() + \". Please use OpenSAML 5\");\n\t}\n\n\tstatic BeanMetadataElement getAuthenticationConverter(Element element) {\n\t\tString authenticationConverter = element.getAttribute(ATT_AUTHENTICATION_CONVERTER);\n\t\tif (StringUtils.hasText(authenticationConverter)) {\n\t\t\treturn new RuntimeBeanReference(authenticationConverter);\n\t\t}\n\t\treturn null;\n\t}","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParserUtils.java#L75-L111","documentation":"Saml2LoginBeanDefinitionParserUtils.createDefaultAuthenticationRequestResolver builds the default SAML2 authentication request resolver. Spring Security supports OpenSAML 5 only; if the classpath has OpenSAML 4 (or another version), USE_OPENSAML_5 is false and createDefaultAuthenticationRequestResolver throws IllegalArgumentException reporting Version.getVersion().","triggerScenarios":"Parsing <saml2-login> XML config while the runtime classpath provides an OpenSAML version other than 5 (e.g., OpenSAML 4 from an older shibboleth dependency), so createDefaultAuthenticationRequestResolver falls through to the throw.","commonSituations":"Legacy applications with explicit OpenSAML 4 dependencies; dependency trees pulling an old opensaml-core transitively; upgrading Spring Security without upgrading OpenSAML.","solutions":["Upgrade the opensaml-core / OpenSAML dependencies to 5.x in your build.","Run a dependency tree (mvn dependency:tree) and force OpenSAML 5 versions.","If OpenSAML 4 must stay, use Java DSL configuration instead of the saml2 XML namespace and supply compatible components manually."],"exampleFix":"// before\n<dependency>\n  <groupId>org.opensaml</groupId>\n  <artifactId>opensaml-core</artifactId>\n  <version>4.3.0</version>\n</dependency>\n// after\n<dependency>\n  <groupId>org.opensaml</groupId>\n  <artifactId>opensaml-core</artifactId>\n  <version>5.1.0</version>\n</dependency>","handlingStrategy":"validation","validationCode":"String v = org.opensaml.core.Version.getVersion();\nif (!v.startsWith(\"5.\")) { throw new IllegalStateException(\"SAML2 XML config requires OpenSAML 5, found \" + v); }","typeGuard":null,"tryCatchPattern":"try { ctx.refresh(); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"OpenSAML\")) { throw new ConfigurationException(\"Upgrade opensaml-core to 5.x: \" + e.getMessage()); } throw e; }","preventionTips":["Pin opensaml-core to a 5.x version in dependencyManagement","Check the dependency tree for transitive OpenSAML 4 pulls before adding saml2 config","Verify OpenSAML version at application startup when using saml2-login"],"tags":["spring-security","saml","opensaml","version-incompatibility","dependency"],"backgroundTag":"unsupported-platform","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}