spring-projects/spring-security · error · IllegalArgumentException

Spring Security does not support OpenSAML {Version.getVersio

Error message

Spring Security does not support OpenSAML {Version.getVersion()}. Please use OpenSAML 5

What it means

Saml2LoginBeanDefinitionParserUtils.createDefaultAuthenticationRequestResolver builds the default SAML2 authentication request resolver. Spring Security supports OpenSAML 5 only; if the classpath has OpenSAML 4 (or another version), USE_OPENSAML_5 is false and createDefaultAuthenticationRequestResolver throws IllegalArgumentException reporting Version.getVersion().

Source

Thrown at config/src/main/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParserUtils.java:93

		String authenticationRequestContextResolver = element.getAttribute(ATT_AUTHENTICATION_REQUEST_RESOLVER_REF);
		if (StringUtils.hasText(authenticationRequestContextResolver)) {
			return new RuntimeBeanReference(authenticationRequestContextResolver);
		}
		return null;
	}

	static BeanMetadataElement createDefaultAuthenticationRequestResolver(
			BeanMetadataElement relyingPartyRegistrationRepository) {
		BeanMetadataElement defaultRelyingPartyRegistrationResolver = BeanDefinitionBuilder
			.rootBeanDefinition(DefaultRelyingPartyRegistrationResolver.class)
			.addConstructorArgValue(relyingPartyRegistrationRepository)
			.getBeanDefinition();
		if (USE_OPENSAML_5) {
			return BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5AuthenticationRequestResolver.class)
				.addConstructorArgValue(defaultRelyingPartyRegistrationResolver)
				.getBeanDefinition();
		}
		throw new IllegalArgumentException(
				"Spring Security does not support OpenSAML " + Version.getVersion() + ". Please use OpenSAML 5");
	}

	static BeanDefinition createAuthenticationProvider() {
		if (USE_OPENSAML_5) {
			return BeanDefinitionBuilder.rootBeanDefinition(OpenSaml5AuthenticationProvider.class).getBeanDefinition();
		}
		throw new IllegalArgumentException(
				"Spring Security does not support OpenSAML " + Version.getVersion() + ". Please use OpenSAML 5");
	}

	static BeanMetadataElement getAuthenticationConverter(Element element) {
		String authenticationConverter = element.getAttribute(ATT_AUTHENTICATION_CONVERTER);
		if (StringUtils.hasText(authenticationConverter)) {
			return new RuntimeBeanReference(authenticationConverter);
		}
		return null;
	}

View on GitHub (pinned to 96852e8860)

Solutions

1. Upgrade the opensaml-core / OpenSAML dependencies to 5.x in your build.
2. Run a dependency tree (mvn dependency:tree) and force OpenSAML 5 versions.
3. If OpenSAML 4 must stay, use Java DSL configuration instead of the saml2 XML namespace and supply compatible components manually.

Example fix

// before
<dependency>
  <groupId>org.opensaml</groupId>
  <artifactId>opensaml-core</artifactId>
  <version>4.3.0</version>
</dependency>
// after
<dependency>
  <groupId>org.opensaml</groupId>
  <artifactId>opensaml-core</artifactId>
  <version>5.1.0</version>
</dependency>

String v = org.opensaml.core.Version.getVersion();
if (!v.startsWith("5.")) { throw new IllegalStateException("SAML2 XML config requires OpenSAML 5, found " + v); }

try { ctx.refresh(); } catch (IllegalArgumentException e) { if (e.getMessage().contains("OpenSAML")) { throw new ConfigurationException("Upgrade opensaml-core to 5.x: " + e.getMessage()); } throw e; }

When it happens

Trigger: Parsing <saml2-login> XML config while the runtime classpath provides an OpenSAML version other than 5 (e.g., OpenSAML 4 from an older shibboleth dependency), so createDefaultAuthenticationRequestResolver falls through to the throw.

Common situations: Legacy applications with explicit OpenSAML 4 dependencies; dependency trees pulling an old opensaml-core transitively; upgrading Spring Security without upgrading OpenSAML.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• Spring Security does not support OpenSAML {Version.getVersio
• Saml2Exception wrapping MarshallingException while re-marsha
• Unable to resolve Builder for
• Unsupported element of type
• Failed to deserialize payload

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/cae5d5174fe10116. Report an issue: GitHub.