{"record":{"id":"e9c09b5923c2b267","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java","lineNumber":83,"sourceCode":"\tprivate interface OpenSamlDeserializer {\n\n\t\tXMLObject deserialize(InputStream serialized);\n\n\t}\n\n\tprivate static class OpenSaml5Deserializer implements OpenSamlDeserializer {\n\n\t\t@Override\n\t\tpublic XMLObject deserialize(InputStream serialized) {\n\t\t\ttry {\n\t\t\t\tParserPool parserPool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\t\tAssert.notNull(parserPool, \"A ParserPool must be configured\");\n\t\t\t\tDocument document = parserPool.parse(serialized);\n\t\t\t\tElement element = document.getDocumentElement();\n\t\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\t\tif (unmarshaller == null) {\n\t\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t\t}\n\t\t\t\treturn unmarshaller.unmarshall(element);\n\t\t\t}\n\t\t\tcatch (Saml2Exception ex) {\n\t\t\t\tthrow ex;\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":65,"sourceCodeEnd":98,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java#L65-L98","documentation":"During metadata deserialization, OpenSAML's UnmarshallerFactory returns no Unmarshaller for the document's root element, meaning the XML namespace/element is not a recognized OpenSAML type. Spring Security surfaces this as a Saml2Exception including the element's tag name.","triggerScenarios":"RelyingPartyRegistrations.fromMetadataLocation/fromMetadata handed an InputStream whose root element is not a SAML-metadata element (e.g. , , ), so factory.getUnmarshaller(element) returns null.","commonSituations":"Metadata URL redirects to a login page (HTML root); proxy/firewall returns an error XML; wrong content served with a 200 status; OpenSAML registry not initialized so even valid elements have no unmarshaller (rare).","solutions":["Fetch the URL manually and check the root element; point fromMetadataLocation at the true metadata document","Ensure the server returns the metadata XML directly (no HTML login redirect) and with correct Content-Type","If a proxy is interfering, bypass it or provide the metadata as a local file/classpath resource instead","If OpenSAML registry initialization is the issue, ensure the OpenSAMLInitializationService/standard providers are on the classpath"],"exampleFix":"// before: URL that redirects to HTML login\n.fromMetadataLocation(\"https://idp.example.com/protected-metadata\")\n// after: use a direct or authenticated-fetch source\n.fromMetadataLocation(\"classpath:idp-metadata.xml\")","handlingStrategy":"validation","validationCode":"byte[] body = fetch(metadataUrl);\nDocument doc = parseXml(body);\nString rootNs = doc.getDocumentElement().getNamespaceURI();\nif (!\"urn:oasis:names:tc:SAML:2.0:metadata\".equals(rootNs)) {\n throw new IllegalArgumentException(\"Root element is not SAML 2.0 metadata: \" + rootNs);\n}","typeGuard":null,"tryCatchPattern":"try {\n return RelyingPartyRegistrations.fromMetadata(in);\n} catch (Saml2Exception ex) {\n if (ex.getMessage() != null && ex.getMessage().startsWith(\"Unsupported element of type\")) {\n // includes offending tag name — route to correct metadata endpoint\n throw new IllegalStateException(\"Unknown root element served at metadata URL\", ex);\n }\n throw ex;\n}","preventionTips":["Confirm the endpoint returns XML with the SAML 2.0 metadata namespace","Watch for redirect-to-login or error pages consumed as metadata","Keep OpenSAML-dependent dependencies intact so unmarshallers are registered"],"tags":["saml2","deserialization","metadata","unsupported-element"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}