spring-projects/spring-security · error · Saml2Exception

Unable to deflate string

Error message

Unable to deflate string

What it means

Identical to the main Saml2Utils but located in the logout package: samlDeflate compresses a SAML logout message using raw DEFLATE for HTTP-Redirect binding. Saml2Exception "Unable to deflate string" is thrown on IOException during the in-memory deflate, which is practically a JVM-internal resource failure.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/authentication/logout/Saml2Utils.java:61

	static String samlEncode(byte[] b) {
		return Base64.getEncoder().encodeToString(b);
	}

	static byte[] samlDecode(String s) {
		return Base64.getMimeDecoder().decode(s);
	}

	static byte[] samlDeflate(String s) {
		try {
			ByteArrayOutputStream b = new ByteArrayOutputStream();
			DeflaterOutputStream deflater = new DeflaterOutputStream(b, new Deflater(Deflater.DEFLATED, true));
			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);

View on GitHub (pinned to 96852e8860)

Solutions

  1. Retry the logout operation — usually transient/environmental
  2. Increase JVM heap if messages are very large
  3. Inspect the wrapped cause for the actual failure and upgrade JVM if a java.util.zip defect is implicated
Defensive patterns

Strategy: try-catch

Validate before calling

if (logoutXml == null || logoutXml.isEmpty()) {
    throw new IllegalArgumentException("empty logout message, skip deflate");
}

Try / catch

try {
    byte[] deflated = Saml2Utils.samlDeflate(logoutXml);
} catch (Saml2Exception e) {
    // transient/resource issue: retry or surface SLO failure
}

Prevention

When it happens

Trigger: logout Saml2Utils.samlDeflate(String s) writes to a DeflaterOutputStream over a ByteArrayOutputStream; the catch (IOException) branch throws — effectively only on memory exhaustion or Deflater failure during single-logout message encoding.

Common situations: Very large logout messages or constrained heap; transient JVM resource exhaustion while encoding SLO redirect URLs.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/42e3c5612ad48266. Report an issue: GitHub.