spring-projects/spring-security · error · Saml2Exception

Unsupported element type:

Error message

Unsupported element type: 

What it means

OpenSamlMetadataUtils.descriptors only knows how to turn an XMLObject of type EntityDescriptor or EntitiesDescriptor into a collection of EntityDescriptors. Any other element type (e.g. a bare Assertion, AttributeQueryDescriptor, or an unmarshalled wrapper) triggers this Saml2Exception naming the offending class.

Source

Thrown at saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/registration/OpenSamlMetadataUtils.java:62

	}

	static OpenSamlDeserializer resolveDeserializer() {
		return new OpenSaml5Deserializer();
	}

	private OpenSamlMetadataUtils() {

	}

	static Collection<EntityDescriptor> descriptors(InputStream metadata) {
		XMLObject object = saml.deserialize(metadata);
		if (object instanceof EntityDescriptor descriptor) {
			return Collections.singleton(descriptor);
		}
		if (object instanceof EntitiesDescriptor descriptors) {
			return descriptors.getEntityDescriptors();
		}
		throw new Saml2Exception("Unsupported element type: " + object.getClass().getName());
	}

	private interface OpenSamlDeserializer {

		XMLObject deserialize(InputStream serialized);

	}

	private static class OpenSaml5Deserializer implements OpenSamlDeserializer {

		@Override
		public XMLObject deserialize(InputStream serialized) {
			try {
				ParserPool parserPool = XMLObjectProviderRegistrySupport.getParserPool();
				Assert.notNull(parserPool, "A ParserPool must be configured");
				Document document = parserPool.parse(serialized);
				Element element = document.getDocumentElement();
				UnmarshallerFactory factory = XMLObjectProviderRegistrySupport.getUnmarshallerFactory();

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify the metadata URL/file actually returns <EntityDescriptor> or <EntitiesDescriptor> as the root (curl it and inspect the root tag)
2. Use the correct IdP metadata endpoint (often /saml/metadata or /Shibboleth.sso/Metadata) rather than the SSO endpoint
3. If the IdP only publishes federation (EntitiesDescriptor) aggregates, that is supported — but the error class name will tell you what was actually received; align your input accordingly

Example fix

// before
RelyingPartyRegistration r = RelyingPartyRegistrations.fromMetadataLocation("https://idp.example.com/sso/SSO"); // wrong endpoint
// after
RelyingPartyRegistration r = RelyingPartyRegistrations.fromMetadataLocation("https://idp.example.com/saml/metadata"); // real metadata endpoint

byte[] body = fetch(metadataUrl);
String root = rootElementName(body); // parse and read document element
if (!root.equals("EntityDescriptor") && !root.equals("EntitiesDescriptor")) {
    throw new IllegalArgumentException("Expected SAML metadata, got root element: " + root);
}

try {
    return RelyingPartyRegistrations.collectionFromMetadata(in);
} catch (Saml2Exception ex) {
    if (ex.getMessage() != null && ex.getMessage().startsWith("Unsupported element type")) {
        throw new IllegalStateException("Metadata URL returned a non-metadata document — check the URL", ex);
    }
    throw ex;
}

When it happens

Trigger: Feeding RelyingPartyRegistrations.fromMetadata/collectionFromMetadata (via OpenSamlMetadataUtils) a SAML document whose root element is neither EntityDescriptor nor EntitiesDescriptor.

Common situations: Pointing fromMetadataLocation at the wrong endpoint (e.g. an IdP's SSO URL or a SOAP error document instead of the metadata URL); serving HTML or an XML error page at the metadata URL; passing a serialized SAML assertion by mistake.

Related errors

• Metadata response is missing verification certificates, nece
• Metadata response is missing a SingleSignOnService, necessar
• Unsupported element of type
• Metadata response is missing the necessary IDPSSODescriptor
• registration not found

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/c1ba6643f58e44a6. Report an issue: GitHub.