spring-projects/spring-security · error · Saml2Exception

Unsupported object of type:

Error message

Unsupported object of type: 

What it means

Same family as error 583, in the logout OpenSaml5Template: its verify() method only handles Assertion instances; passing any other SignableXMLObject (such as a LogoutResponse) reaches the terminal throw of Saml2Exception naming the object's class.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/logout/OpenSaml5Template.java:392

			if (signable instanceof StatusResponseType response) {
				Assert.notNull(response.getID(), "Response#ID cannot be null");
				Assert.notNull(response.getIssuer(), "Response#Issuer cannot be null");
				Assert.notNull(response.getSignature(), "Response#Signature cannot be null");
				return verifySignature(response.getID(), response.getIssuer(), response.getSignature());
			}
			if (signable instanceof RequestAbstractType request) {
				Assert.notNull(request.getID(), "Request#ID cannot be null");
				Assert.notNull(request.getIssuer(), "Request#Issuer cannot be null");
				Assert.notNull(request.getSignature(), "Request#Signature cannot be null");
				return verifySignature(request.getID(), request.getIssuer(), request.getSignature());
			}
			if (signable instanceof Assertion assertion) {
				Assert.notNull(assertion.getID(), "Assertion#ID cannot be null");
				Assert.notNull(assertion.getIssuer(), "Assertion#Issuer cannot be null");
				Assert.notNull(assertion.getSignature(), "Assertion#Signature cannot be null");
				return verifySignature(assertion.getID(), assertion.getIssuer(), assertion.getSignature());
			}
			throw new Saml2Exception("Unsupported object of type: " + signable.getClass().getName());
		}

		private Collection<Saml2Error> verifySignature(String id, Issuer issuer, Signature signature) {
			SignatureTrustEngine trustEngine = trustEngine(this.credentials);
			CriteriaSet criteria = verificationCriteria(issuer);
			Collection<Saml2Error> errors = new ArrayList<>();
			SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
			try {
				profileValidator.validate(signature);
			}
			catch (Exception ex) {
				errors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,
						"Invalid signature for object [" + id + "]: "));
			}

			try {
				if (!trustEngine.validate(signature, criteria)) {
					errors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,

View on GitHub (pinned to 96852e8860)

Solutions

1. Verify signatures on the contained Assertion, or for logout messages use a SignatureTrustEngine (or Spring Security's Saml2LogoutValidator chain) that supports response-level signatures.
2. Build a SignatureTrustEngine from the SP credentials and verify the LogoutRequest/LogoutResponse signature yourself.
3. Use OpenSaml5AuthenticationProvider / Saml2LogoutValidator infrastructure which handles both response and assertion signature validation.
4. If the object should be an Assertion, check why a different type was passed (extraction logic bug) before calling verify().

Example fix

// before
LogoutResponse resp = ...;
template.verify(resp); // unsupported

// after
LogoutResponse resp = ...;
if (resp.getAssertions().size() > 0) {
    template.verify(resp.getAssertions().get(0));
} // or use SignatureTrustEngine for message-level signature

if (!(signable instanceof Assertion)) {
    throw new IllegalArgumentException("logout template verify() supports Assertions only, got " + signable.getClass().getName());
}

boolean isAssertion(SignableXMLObject o) { return o instanceof Assertion; }

try { template.verify(signable); } catch (Saml2Exception ex) { log.error("Unsupported type for logout verify(): {}", signable.getClass().getName()); throw ex; }

When it happens

Trigger: Calling logout OpenSaml5Template.verify(SignableXMLObject) with a non-Assertion object, so the instanceof Assertion check fails and the exception is thrown.

Common situations: Attempting to verify the signature of a LogoutResponse or LogoutRequest during single-logout processing; wrapping logic that forwards the whole SAML message to verify(); unit tests exercising verify() with mock signable objects.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Unsupported object of type:
• Unable to resolve Builder for
• Unsupported element of type
• Failed to deserialize payload
• Spring Security does not support OpenSAML {Version.getVersio

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/0454a0f5a4a491e9. Report an issue: GitHub.