spring-projects/spring-security · error · Saml2Exception

Unable to inflate string

Error message

Unable to inflate string

What it means

Thrown by Saml2Utils.samlInflate when DEFLATE-inflating a decoded SAML message (Redirect binding) fails with an IOException. The base64-decoded value was not valid zlib/DEFLATE data. Wrapped as Saml2Exception with the original IOException as cause.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/Saml2Utils.java:74

			deflater.write(s.getBytes(StandardCharsets.UTF_8));
			deflater.finish();
			return b.toByteArray();
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to deflate string", ex);
		}
	}

	static String samlInflate(byte[] b) {
		try {
			ByteArrayOutputStream out = new ByteArrayOutputStream();
			InflaterOutputStream iout = new InflaterOutputStream(new CappedOutputStream(out), new Inflater(true));
			iout.write(b);
			iout.finish();
			return new String(out.toByteArray(), StandardCharsets.UTF_8);
		}
		catch (IOException ex) {
			throw new Saml2Exception("Unable to inflate string", ex);
		}
	}

	static EncodingConfigurer withDecoded(String decoded) {
		return new EncodingConfigurer(decoded);
	}

	static DecodingConfigurer withEncoded(String encoded) {
		return new DecodingConfigurer(encoded);
	}

	static final class EncodingConfigurer {

		private final String decoded;

		private boolean deflate;

		private EncodingConfigurer(String decoded) {

View on GitHub (pinned to 96852e8860)

Solutions

  1. Confirm the IDP applies DEFLATE (raw, no zlib header) before base64-encoding when using Redirect binding
  2. Verify SigAlg/URL decoding: ensure the parameter is URL-decoded before base64-decode (missing '+' handling corrupts bytes)
  3. Compare a captured request from the IDP: decode manually and check it inflates
  4. Check for intermediaries altering the query parameter encoding
Defensive patterns

Strategy: try-catch

Try / catch

try { /* redirect-binding saml processing */ } catch (Saml2Exception ex) {
    log.warn("SAML message could not be inflated; check IDP binding config", ex);
    response.sendError(HttpServletResponse.SC_BAD_REQUEST);
}

Prevention

When it happens

Trigger: Processing a SAML message received via HTTP-Redirect binding whose base64-decoded bytes are not DEFLATE-compressed — e.g. the sender sent raw XML or plain base64 without compression, or the value was corrupted in transit.

Common situations: IDP configured for Redirect binding but sending uncompressed payload; double base64-encoding; URL-decoding issues mangling '+' and '=' in the query string before decode; proxies rewriting the SAMLRequest/SAMLResponse parameter.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/ede0f593b508d994. Report an issue: GitHub.