{"record":{"id":"cdacbe350f461238","repo":"spring-projects/spring-security","slug":"unsupported-object-of-type-cdacbe","errorCode":null,"errorMessage":"Unsupported object of type: ","messagePattern":"Unsupported object of type: ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java","lineNumber":392,"sourceCode":"\t\t\tif (signable instanceof StatusResponseType response) {\n\t\t\t\tAssert.notNull(response.getID(), \"Response#ID cannot be null\");\n\t\t\t\tAssert.notNull(response.getIssuer(), \"Response#Issuer cannot be null\");\n\t\t\t\tAssert.notNull(response.getSignature(), \"Response#Signature cannot be null\");\n\t\t\t\treturn verifySignature(response.getID(), response.getIssuer(), response.getSignature());\n\t\t\t}\n\t\t\tif (signable instanceof RequestAbstractType request) {\n\t\t\t\tAssert.notNull(request.getID(), \"Request#ID cannot be null\");\n\t\t\t\tAssert.notNull(request.getIssuer(), \"Request#Issuer cannot be null\");\n\t\t\t\tAssert.notNull(request.getSignature(), \"Request#Signature cannot be null\");\n\t\t\t\treturn verifySignature(request.getID(), request.getIssuer(), request.getSignature());\n\t\t\t}\n\t\t\tif (signable instanceof Assertion assertion) {\n\t\t\t\tAssert.notNull(assertion.getID(), \"Assertion#ID cannot be null\");\n\t\t\t\tAssert.notNull(assertion.getIssuer(), \"Assertion#Issuer cannot be null\");\n\t\t\t\tAssert.notNull(assertion.getSignature(), \"Assertion#Signature cannot be null\");\n\t\t\t\treturn verifySignature(assertion.getID(), assertion.getIssuer(), assertion.getSignature());\n\t\t\t}\n\t\t\tthrow new Saml2Exception(\"Unsupported object of type: \" + signable.getClass().getName());\n\t\t}\n\n\t\tprivate Collection<Saml2Error> verifySignature(String id, Issuer issuer, Signature signature) {\n\t\t\tSignatureTrustEngine trustEngine = trustEngine(this.credentials);\n\t\t\tCriteriaSet criteria = verificationCriteria(issuer);\n\t\t\tCollection<Saml2Error> errors = new ArrayList<>();\n\t\t\tSAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();\n\t\t\ttry {\n\t\t\t\tprofileValidator.validate(signature);\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\terrors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,\n\t\t\t\t\t\t\"Invalid signature for object [\" + id + \"]: \"));\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tif (!trustEngine.validate(signature, criteria)) {\n\t\t\t\t\terrors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,","sourceCodeStart":374,"sourceCodeEnd":410,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java#L374-L410","documentation":"OpenSaml5Template.verify() only supports verifying signatures on SAML objects of known types (e.g. Assertion, Response, EncryptedAssertion). If a SignableXMLObject of another type is passed, it throws Saml2Exception('Unsupported object of type: ' + className). This guards against silently accepting objects whose signature verification semantics are not implemented.","triggerScenarios":"Invoking the public verify(SignableXMLObject) with a signable object that is not an Assertion (or the other supported types), e.g. a raw Response, SubjectConfirmationData, ArtifactResolve, or a custom OpenSAML element.","commonSituations":"Custom SAML processing code calling the template's verification method directly with an unsupported element; library version differences where a new SAML element is routed to verify; refactoring that changed which object is passed to verification.","solutions":["Only pass Assertion/Response (supported signables) to verify()","Verify the enclosing Response/Assertion in OpenSamlAuthenticationProvider instead of ad-hoc elements","Extend the verify method (subclass or upstream contribution) if you genuinely need another signable type","Log signable.getClass().getName() to identify which object leaked in"],"exampleFix":"// before\ntemplate.verify(subjectConfirmationData);\n// after\ntemplate.verify(assertion); // verify at the supported container level","handlingStrategy":"type-guard","validationCode":"if (!(signable instanceof Assertion) && !(signable instanceof Response)) throw new IllegalArgumentException(\"verify() supports only Assertion/Response\");","typeGuard":"function isVerifiable(o) { return o instanceof Assertion || o instanceof Response; }","tryCatchPattern":"try { errors = template.verify(obj); } catch (Saml2Exception e) { throw new UnsupportedOperationException(\"Verify unsupported for \" + obj.getClass(), e); }","preventionTips":["Verify signatures at the Response/Assertion level via OpenSamlAuthenticationProvider","Don't route raw child elements (Subject, Statements) into verify()","Check the signable type before invoking"],"tags":["saml","signature-verification","unsupported-operation","spring-security"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}