spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping MarshallingException during serializ

Error message

Saml2Exception wrapping MarshallingException during serialization

What it means

OpenSaml5Template.serialize(XMLObject) marshals the object to DOM via an OpenSAML Marshaller; any MarshallingException thrown during that operation is rethrown as a Saml2Exception with the original cause. It signals OpenSAML could not convert the in-memory XMLObject into its DOM representation.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java:172

			return (T) unmarshaller.unmarshall(element);
		}
		catch (Saml2Exception ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new Saml2Exception("Failed to deserialize payload", ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(XMLObject object) {
		Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
		Assert.notNull(marshaller, "Marshaller for " + object.getElementQName() + " must be configured");
		try {
			return serialize(marshaller.marshall(object));
		}
		catch (MarshallingException ex) {
			throw new Saml2Exception(ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(Element element) {
		return new OpenSaml5SerializationConfigurer(element);
	}

	@Override
	public OpenSaml5SignatureConfigurer withSigningKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5SignatureConfigurer(credentials);
	}

	@Override
	public OpenSaml5VerificationConfigurer withVerificationKeys(Collection<Saml2X509Credential> credentials) {
		return new OpenSaml5VerificationConfigurer(credentials);
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Check ex.getCause()/stack trace for the underlying MarshallingException reason and fix the XMLObject content
2. Ensure the XMLObject was fully built via template.build()/proper builders, not partially constructed
3. Verify opensaml-saml-impl is present and OpenSAML is initialized so marshallers are registered
4. Confirm all required child attributes/elements are set before serialization

Example fix

// before
Response r = (Response) XMLObjectProviderRegistrySupport.getBuilderFactory().getBuilder(Response.DEFAULT_ELEMENT_NAME).buildObject(Response.DEFAULT_ELEMENT_NAME);
// after (use the template so builders/marshallers are guaranteed initialized)
Response r = template.build(Response.DEFAULT_ELEMENT_NAME);
r.setID("_id");
String xml = template.serialize(r).prettyPrint();

Assert.notNull(XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object),
    "No marshaller for " + object.getElementQName());

try {
    return template.serialize(object).prettyPrint();
} catch (Saml2Exception ex) {
    logger.warn("Marshalling failed for " + object.getElementQName(), ex);
    throw ex;
}

When it happens

Trigger: template.serialize(xmlObject) when marshall(object) fails — e.g. the object contains elements whose marshaller is missing, namespace conflicts, or an object tree in an inconsistent state (required child with no value, invalid QName).

Common situations: Serializing a hand-built XMLObject missing mandatory structure; registry misconfiguration so the element's marshaller is absent (in that case the preceding Assert.notNull throws instead); OpenSAML version mismatch producing inconsistent marshaller registries.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

• Saml2Exception wrapping MarshallingException while re-marsha
• Saml2Exception wrapping MarshallingException during serializ
• Unsupported element of type
• Failed to deserialize payload
• subject_not_found

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b68c84ea3c5c376c. Report an issue: GitHub.