spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping MarshallingException during…

Error message

Saml2Exception wrapping MarshallingException during serialization

What it means

OpenSaml5Template.serialize(XMLObject) marshals the XMLObject to a DOM Element via OpenSAML's Marshaller; a MarshallingException is wrapped in Saml2Exception. This means the SAML object could not be serialized to XML, typically because the object is structurally invalid or in an inconsistent build state.

Solutions

Inspect the wrapped MarshallingException message for the specific schema/structure violation
Build objects via OpenSamlTemplate.build() so required fields (IDs, IssueInstant) are populated by default
Validate the object (schema validators) before marshalling
Create a fresh XMLObject instead of mutating/re-marshalling a previously marshalled instance

Example fix

// before
Response r = buildResponse();
r.setID(null); // marshall requires an ID
serialize(r); // MarshallingException
// after
Response r = buildResponse(); // builder sets ID/IssueInstant defaults
serialize(r);

Defensive patterns

Strategy: try-catch

Validate before calling

Marshaller m = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
if (m == null) throw new IllegalStateException("No marshaller for " + object.getElementQName());
// schema-validate the object before marshalling
XMLObjectSupport.validate(object);

Try / catch

try {
    return template.serialize(object);
} catch (Saml2Exception ex) {
    if (ex.getCause() instanceof MarshallingException)
        throw new IllegalStateException("SAML object could not be marshalled: " + ex.getCause().getMessage(), ex);
    throw ex;
}

Prevention

Build XMLObjects via OpenSamlTemplate.build() so required fields are defaulted
Never mutate a signed/marshalled object before re-serializing
Schema-validate complex hand-built objects before marshalling

When it happens

Trigger: Calling serialize(object) where marshaller.marshall(object) throws — e.g. the object was built manually without required attributes (like an ID on a SignableXMLObject), a marshalling rule violation, or no marshaller exists (caught earlier by Assert.notNull).

Common situations: Constructing XMLObjects by hand and missing required schema fields; reusing/marshalling an object whose DOM owner document conflicts; modifying an object after signing causing validator failures during marshall.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/9c99dd4d1caf7fe3. Report an issue: GitHub.

Appendix: source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java:172

			return (T) unmarshaller.unmarshall(element);
		}
		catch (Saml2Exception ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new Saml2Exception("Failed to deserialize payload", ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(XMLObject object) {
		Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
		Assert.notNull(marshaller, "Marshaller for " + object.getElementQName() + " must be configured");
		try {
			return serialize(marshaller.marshall(object));
		}
		catch (MarshallingException ex) {
			throw new Saml2Exception(ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(Element element) {
		return new OpenSaml5SerializationConfigurer(element);
	}

	@Override
	public OpenSaml5SignatureConfigurer withSigningKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5SignatureConfigurer(credentials);
	}

	@Override
	public OpenSaml5VerificationConfigurer withVerificationKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5VerificationConfigurer(credentials);
	}

View on GitHub (pinned to 96852e8860)