spring-projects/spring-security · error · IllegalArgumentException

Spring Security does not support OpenSAML {Version.getVersio

Error message

Spring Security does not support OpenSAML {Version.getVersion()}. Please use OpenSAML 5

What it means

Saml2LogoutBeanDefinitionParserUtils.getLogoutResponseResolver creates the default OpenSaml5LogoutResponseResolver for <saml2-logout>. Spring Security requires OpenSAML 5; any other version triggers IllegalArgumentException reporting Version.getVersion() (Saml2LogoutBeanDefinitionParserUtils.java:77).

Source

Thrown at config/src/main/java/org/springframework/security/config/http/Saml2LogoutBeanDefinitionParserUtils.java:77

		String relyingPartyRegistrationRepositoryRef = element
			.getAttribute(ATT_RELYING_PARTY_REGISTRATION_REPOSITORY_REF);
		if (StringUtils.hasText(relyingPartyRegistrationRepositoryRef)) {
			return new RuntimeBeanReference(relyingPartyRegistrationRepositoryRef);
		}
		return new RuntimeBeanReference(RelyingPartyRegistrationRepository.class);
	}

	static BeanMetadataElement getLogoutResponseResolver(Element element, BeanMetadataElement registrations) {
		String logoutResponseResolver = element.getAttribute(ATT_LOGOUT_RESPONSE_RESOLVER_REF);
		if (StringUtils.hasText(logoutResponseResolver)) {
			return new RuntimeBeanReference(logoutResponseResolver);
		}
		if (USE_OPENSAML_5) {
			return BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5LogoutResponseResolver.class)
				.addConstructorArgValue(registrations)
				.getBeanDefinition();
		}
		throw new IllegalArgumentException(
				"Spring Security does not support OpenSAML " + Version.getVersion() + ". Please use OpenSAML 5");
	}

	static BeanMetadataElement getLogoutRequestValidator(Element element) {
		String logoutRequestValidator = element.getAttribute(ATT_LOGOUT_REQUEST_VALIDATOR_REF);
		if (StringUtils.hasText(logoutRequestValidator)) {
			return new RuntimeBeanReference(logoutRequestValidator);
		}
		if (USE_OPENSAML_5) {
			return BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5LogoutRequestValidator.class).getBeanDefinition();
		}
		throw new IllegalArgumentException(
				"Spring Security does not support OpenSAML " + Version.getVersion() + ". Please use OpenSAML 5");
	}

	static BeanMetadataElement getLogoutResponseValidator(Element element) {
		String logoutResponseValidator = element.getAttribute(ATT_LOGOUT_RESPONSE_VALIDATOR_REF);
		if (StringUtils.hasText(logoutResponseValidator)) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Upgrade OpenSAML to 5.x across all opensaml-* modules.
2. Exclude or re-pin transitive OpenSAML 4 dependencies.
3. Provide a custom logout-response-resolver-ref to bypass the default factory (only if the custom resolver itself is OpenSAML-version compatible).

Example fix

// before
<dependency-management><dependency><groupId>org.opensaml</groupId><artifactId>opensaml-core</artifactId><version>4.x</version></dependency></dependency-management>
// after
<dependency-management><dependency><groupId>org.opensaml</groupId><artifactId>opensaml-core</artifactId><version>5.1.0</version></dependency></dependency-management>

if (!org.opensaml.core.Version.getVersion().startsWith("5.")) { throw new IllegalStateException("OpenSAML 5 required for <saml2-logout>"); }

try { ctx.refresh(); } catch (IllegalArgumentException e) { if (e.getMessage().contains("OpenSAML")) { throw new ConfigurationException("Upgrade OpenSAML to 5.x for saml2-logout"); } throw e; }

When it happens

Trigger: Parsing <saml2-logout> XML config without a logout-response-validator-ref while the classpath has OpenSAML != 5, so getLogoutResponseResolver reaches the throw instead of building OpenSaml5LogoutResponseResolver.

Common situations: Apps with OpenSAML 4 from legacy SAML integration enabling saml2-logout; mismatched OpenSAML module versions in the dependency tree.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• Spring Security does not support OpenSAML {Version.getVersio
• Saml2Exception wrapping MarshallingException while re-marsha
• Unable to resolve Builder for
• Unsupported element of type
• Failed to deserialize payload

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5fc4c8f19eaaa8b1. Report an issue: GitHub.