spring-projects/spring-security · error · Saml2Exception

Unsupported element of type

Error message

Unsupported element of type 

What it means

OpenSaml5Template.deserialize(String) parses the XML payload and asks the OpenSAML UnmarshallerFactory for an unmarshaller for the document's root element. If none is registered, Saml2Exception('Unsupported element of type ...') is thrown. This means the incoming XML's root element is not recognized by OpenSAML's provider registry.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java:152

		return (T) builder.buildObject(elementName);
	}

	@Override
	public <T extends XMLObject> T deserialize(String serialized) {
		return deserialize(new ByteArrayInputStream(serialized.getBytes(StandardCharsets.UTF_8)));
	}

	@Override
	public <T extends XMLObject> T deserialize(InputStream serialized) {
		try {
			ParserPool pool = XMLObjectProviderRegistrySupport.getParserPool();
			Assert.notNull(pool, "ParserPool must be configured");
			Document document = pool.parse(serialized);
			Element element = document.getDocumentElement();
			UnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();
			Unmarshaller unmarshaller = factory.getUnmarshaller(element);
			if (unmarshaller == null) {
				throw new Saml2Exception("Unsupported element of type " + element.getTagName());
			}
			return (T) unmarshaller.unmarshall(element);
		}
		catch (Saml2Exception ex) {
			throw ex;
		}
		catch (Exception ex) {
			throw new Saml2Exception("Failed to deserialize payload", ex);
		}
	}

	@Override
	public OpenSaml5SerializationConfigurer serialize(XMLObject object) {
		Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().getMarshaller(object);
		Assert.notNull(marshaller, "Marshaller for " + object.getElementQName() + " must be configured");
		try {
			return serialize(marshaller.marshall(object));
		}

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify the endpoint receives only SAML protocol messages and inspect the actual root element in the payload
2. Ensure the XML namespaces are correct (SAML 2.0 protocol/assertion namespaces, not SAML 1.x)
3. Initialize OpenSAML providers (OpenSamlInitializationService.initialize()) so unmarshalling factories are populated
4. Register custom unmarshalling providers for any extension elements you must accept

Example fix

// before
String xml = request.getParameter("payload"); // arbitrary, non-SAML
Saml2Response parsed = template.deserialize(xml);
// after
String xml = request.getParameter("SAMLResponse"); // expected SAML document
if (!xml.contains(SAMLConstants.SAML20_NS)) throw new IllegalArgumentException("not SAML 2.0");
Saml2Response parsed = template.deserialize(xml);

Document doc = parserPool.parse(serialized);
String tag = doc.getDocumentElement().getTagName();
Unmarshaller u = XMLObjectProviderRegistrySupport.getUnmarshallerFactory().getUnmarshaller(doc.getDocumentElement());
if (u == null) throw new IllegalArgumentException("Unsupported root element: " + tag);

try {
    return template.deserialize(xml);
} catch (Saml2Exception ex) {
    if (ex.getMessage().startsWith("Unsupported element of type"))
        throw new Saml2AuthenticationException("Unexpected SAML root element — check SAML version/namespaces", ex);
    throw ex;
}

When it happens

Trigger: deserialize() is given XML whose root element QName has no registered unmarshaller — non-SAML XML, unknown SAML version (e.g. a 1.0 protocol element in a 2.0 setup), or vendor extension elements without custom unmarshalling providers.

Common situations: Pointing a processing filter at a non-SAML endpoint that receives arbitrary XML; an IdP sending an unexpected root element (e.g. error document); missing OpenSAML provider initialization for a protocol module.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Unsupported element of type " + element.getTagName()
• Unsupported element of type
• Unsupported element of type
• Unable to resolve Builder for
• Failed to deserialize payload

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/ee2d99c66d547f26. Report an issue: GitHub.