{"record":{"id":"f7785f50d9709a48","repo":"spring-projects/spring-security","slug":"unsupported-element-of-type-f7785f","errorCode":null,"errorMessage":"Unsupported element of type ","messagePattern":"Unsupported element of type ","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java","lineNumber":152,"sourceCode":"\t\treturn (T) builder.buildObject(elementName);\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(String serialized) {\n\t\treturn deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));\n\t}\n\n\t@Override\n\tpublic <T extends XMLObject> T deserialize(InputStream serialized) {\n\t\ttry {\n\t\t\tParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();\n\t\t\tAssert.notNull(pool, \"ParserPool must be configured\");\n\t\t\tDocument document = pool.parse(serialized);\n\t\t\tElement element = document.getDocumentElement();\n\t\t\tUnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();\n\t\t\tUnmarshaller unmarshaller = factory.getUnmarshaller(element);\n\t\t\tif (unmarshaller == null) {\n\t\t\t\tthrow new Saml2Exception(\"Unsupported element of type \" + element.getTagName());\n\t\t\t}\n\t\t\treturn (T) unmarshaller.unmarshall(element);\n\t\t}\n\t\tcatch (Saml2Exception ex) {\n\t\t\tthrow ex;\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new Saml2Exception(\"Failed to deserialize payload\", ex);\n\t\t}\n\t}\n\n\t@Override\n\tpublic OpenSaml5SerializationConfigurer serialize(XMLObject object) {\n\t\tMarshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);\n\t\tAssert.notNull(marshaller, \"Marshaller for \" + object.getElementQName() + \" must be configured\");\n\t\ttry {\n\t\t\treturn serialize(marshaller.marshall(object));\n\t\t}","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java#L134-L170","documentation":"OpenSaml5Template.deserialize() parses the XML string, finds the root element, and asks the OpenSAML UnmarshallerFactory for an Unmarshaller matching that element. If OpenSAML has no unmarshaller registered for the element's QName, the payload cannot be mapped to an XMLObject and this Saml2Exception is thrown. It indicates the XML root is not a registered SAML element (or providers were not initialized).","triggerScenarios":"Calling template.deserialize(String) where the root element is not a known OpenSAML element — e.g. an error page, HTML, or a wrapped SOAP envelope instead of a SAML Response/Assertion — or when OpenSAML providers are not initialized.","commonSituations":"Passing raw IdP HTML error pages or logout HTML to deserialize; wrapping the SAML message in an extra element; missing opensaml-saml-impl dependency so unmarshallers for SAML elements are never registered.","solutions":["Verify the input string's root element is a SAML element (e.g. samlp:Response) — log or validate the root tag name before deserializing","Ensure OpenSAML is initialized (default providers registered) and opensaml-saml-impl is on the classpath","Strip any wrapper elements (SOAP envelopes, HTML) so the root is the SAML element itself","Check for duplicate/conflicting OpenSAML versions on the classpath"],"exampleFix":"// before\nAssertion assertion = template.deserialize(htmlErrorPage);\n// after\nif (!htmlErrorPage.trim().startsWith(\"<saml2:\")) {\n    throw new Saml2Exception(\"Not a SAML document\");\n}\nAssertion assertion = template.deserialize(samlXmlString);","handlingStrategy":"validation","validationCode":"String trimmed = serialized.trim();\nif (!(trimmed.startsWith(\"<\") && (trimmed.contains(\"urn:oasis:names:tc:SAML\")))) {\n    throw new IllegalArgumentException(\"Not a SAML document\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    return template.deserialize(xml);\n} catch (Saml2Exception ex) {\n    logger.warn(\"Unrecognized/unsupported SAML root element\", ex);\n    return null;\n}","preventionTips":["Only deserialize strings you know are SAML messages, not raw IdP responses/HTML","Ensure OpenSAML providers are initialized and opensaml-saml-impl is a dependency","Log the root tag name when deserialization fails to diagnose quickly"],"tags":["saml2","opensaml","deserialization","unmarshaller"],"backgroundTag":"unsupported-operation","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}