spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping MarshallingException during serializ

Error message

Saml2Exception wrapping MarshallingException during serialization

What it means

OpenSaml5Template.serialize(XMLObject) marshals the XMLObject to a DOM Element via OpenSAML's Marshaller; a MarshallingException is wrapped in Saml2Exception. This means the SAML object could not be serialized to XML, typically because the object is structurally invalid or in an inconsistent build state.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java:172

			return (T) unmarshaller.unmarshall(element);
		}
		catch (Saml2Exception ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new Saml2Exception("Failed to deserialize payload", ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(XMLObject object) {
		Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
		Assert.notNull(marshaller, "Marshaller for " + object.getElementQName() + " must be configured");
		try {
			return serialize(marshaller.marshall(object));
		}
		catch (MarshallingException ex) {
			throw new Saml2Exception(ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(Element element) {
		return new OpenSaml5SerializationConfigurer(element);
	}

	@Override
	public OpenSaml5SignatureConfigurer withSigningKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5SignatureConfigurer(credentials);
	}

	@Override
	public OpenSaml5VerificationConfigurer withVerificationKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5VerificationConfigurer(credentials);
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect the wrapped MarshallingException message for the specific schema/structure violation
2. Build objects via OpenSamlTemplate.build() so required fields (IDs, IssueInstant) are populated by default
3. Validate the object (schema validators) before marshalling
4. Create a fresh XMLObject instead of mutating/re-marshalling a previously marshalled instance

Example fix

// before
Response r = buildResponse();
r.setID(null); // marshall requires an ID
serialize(r); // MarshallingException
// after
Response r = buildResponse(); // builder sets ID/IssueInstant defaults
serialize(r);

Marshaller m = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
if (m == null) throw new IllegalStateException("No marshaller for " + object.getElementQName());
// schema-validate the object before marshalling
XMLObjectSupport.validate(object);

try {
    return template.serialize(object);
} catch (Saml2Exception ex) {
    if (ex.getCause() instanceof MarshallingException)
        throw new IllegalStateException("SAML object could not be marshalled: " + ex.getCause().getMessage(), ex);
    throw ex;
}

When it happens

Trigger: Calling serialize(object) where marshaller.marshall(object) throws — e.g. the object was built manually without required attributes (like an ID on a SignableXMLObject), a marshalling rule violation, or no marshaller exists (caught earlier by Assert.notNull).

Common situations: Constructing XMLObjects by hand and missing required schema fields; reusing/marshalling an object whose DOM owner document conflicts; modifying an object after signing causing validator failures during marshall.

Related errors

• Saml2Exception wrapping MarshallingException during serializ
• Saml2Exception wrapping MarshallingException while re-marsha
• Unable to resolve Builder for
• Unsupported element of type
• Saml2Exception wrapping exception while signing XMLObject

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/9c99dd4d1caf7fe3. Report an issue: GitHub.