{"record":{"id":"ee2d99c66d547f26","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-ee2d99","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java#L134-L170","documentation":"OpenSaml5Template.deserialize(String) parses the XML payload and asks the OpenSAML UnmarshallerFactory for an unmarshaller for the document's root element. If none is registered, Saml2Exception('Unsupported element of type ...') is thrown. This means the incoming XML's root element is not recognized by OpenSAML's provider registry.","triggerScenarios":"deserialize() is given XML whose root element QName has no registered unmarshaller — non-SAML XML, unknown SAML version (e.g. a 1.0 protocol element in a 2.0 setup), or vendor extension elements without custom unmarshalling providers.","commonSituations":"Pointing a processing filter at a non-SAML endpoint that receives arbitrary XML; an IdP sending an unexpected root element (e.g. error document); missing OpenSAML provider initialization for a protocol module.","solutions":["Verify the endpoint receives only SAML protocol messages and inspect the actual root element in the payload","Ensure the XML namespaces are correct (SAML 2.0 protocol/assertion namespaces, not SAML 1.x)","Initialize OpenSAML providers (OpenSamlInitializationService.initialize()) so unmarshalling factories are populated","Register custom unmarshalling providers for any extension elements you must accept"],"exampleFix":"// before\nString xml = request.getParameter(\"payload\"); // arbitrary, non-SAML\nSaml2Response parsed = template.deserialize(xml);\n// after\nString xml = request.getParameter(\"SAMLResponse\"); // expected SAML document\nif (!xml.contains(SAMLConstants.SAML20_NS)) throw new IllegalArgumentException(\"not SAML 2.0\");\nSaml2Response parsed = template.deserialize(xml);","handlingStrategy":"validation","validationCode":"Document doc = parserPool.parse(serialized);\nString tag = doc.getDocumentElement().getTagName();\nUnmarshaller u = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(doc.getDocumentElement());\nif (u == null) throw new IllegalArgumentException(\"Unsupported root element: \" + tag);","typeGuard":null,"tryCatchPattern":"try {\n    return template.deserialize(xml);\n} catch (Saml2Exception ex) {\n    if (ex.getMessage().startsWith(\"Unsupported element of type\"))\n        throw new Saml2AuthenticationException(\"Unexpected SAML root element — check SAML version/namespaces\", ex);\n    throw ex;\n}","preventionTips":["Confirm endpoints only receive SAML protocol documents","Check SAML version (1.x vs 2.x) namespaces in incoming payloads","Initialize OpenSAML providers before first deserialize call"],"tags":["saml2","opensaml","deserialize","unmarshaller","spring-security"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}