spring-projects/spring-security · error · Saml2Exception

Unsupported object of type:

Error message

Unsupported object of type: 

What it means

OpenSaml5Template's internal verifier only supports verifying signatures on OpenSAML Assertion objects. If verify() is given any other signable XMLObject (e.g. a Response or LogoutRequest), it throws this Saml2Exception naming the object's class. Assertion verification additionally requires non-null ID, Issuer, and Signature.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/authentication/OpenSaml5Template.java:392

			if (signable instanceof StatusResponseType response) {
				Assert.notNull(response.getID(), "Response#ID cannot be null");
				Assert.notNull(response.getIssuer(), "Response#Issuer cannot be null");
				Assert.notNull(response.getSignature(), "Response#Signature cannot be null");
				return verifySignature(response.getID(), response.getIssuer(), response.getSignature());
			}
			if (signable instanceof RequestAbstractType request) {
				Assert.notNull(request.getID(), "Request#ID cannot be null");
				Assert.notNull(request.getIssuer(), "Request#Issuer cannot be null");
				Assert.notNull(request.getSignature(), "Request#Signature cannot be null");
				return verifySignature(request.getID(), request.getIssuer(), request.getSignature());
			}
			if (signable instanceof Assertion assertion) {
				Assert.notNull(assertion.getID(), "Assertion#ID cannot be null");
				Assert.notNull(assertion.getIssuer(), "Assertion#Issuer cannot be null");
				Assert.notNull(assertion.getSignature(), "Assertion#Signature cannot be null");
				return verifySignature(assertion.getID(), assertion.getIssuer(), assertion.getSignature());
			}
			throw new Saml2Exception("Unsupported object of type: " + signable.getClass().getName());
		}

		private Collection<Saml2Error> verifySignature(String id, Issuer issuer, Signature signature) {
			SignatureTrustEngine trustEngine = trustEngine(this.credentials);
			CriteriaSet criteria = verificationCriteria(issuer);
			Collection<Saml2Error> errors = new ArrayList<>();
			SAMLSignatureProfileValidator profileValidator = new SAMLSignatureProfileValidator();
			try {
				profileValidator.validate(signature);
			}
			catch (Exception ex) {
				errors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,
						"Invalid signature for object [" + id + "]: "));
			}

			try {
				if (!trustEngine.validate(signature, criteria)) {
					errors.add(new Saml2Error(Saml2ErrorCodes.INVALID_SIGNATURE,

View on GitHub (pinned to 96852e8860)

Solutions

1. Extract the Assertion from the Response and pass the Assertion to verify() instead of the Response itself.
2. If response-level signature verification is needed, use OpenSAML's SignatureTrustEngine directly or rely on Spring Security's OpenSaml5AuthenticationProvider, which validates response/assertion signatures via validators.
3. For non-Assertion signable types, implement your own verification using a SignatureTrustEngine built from your credentials.
4. Ensure the object is an Assertion with non-null ID, Issuer, and Signature, or the earlier Assert checks will fail instead.

Example fix

// before
Response response = ...;
template.verify(response); // unsupported type

// after
Response response = ...;
for (Assertion assertion : response.getAssertions()) {
    template.verify(assertion);
}

if (!(signable instanceof Assertion a) || a.getID() == null || a.getIssuer() == null || a.getSignature() == null) {
    throw new IllegalArgumentException("verify() requires an Assertion with ID, Issuer and Signature");
}

boolean isVerifiableAssertion(SignableXMLObject o) {
    return o instanceof Assertion a && a.getID() != null && a.getIssuer() != null && a.getSignature() != null;
}

try { template.verify(signable); } catch (Saml2Exception ex) { log.error("Unsupported signable type: {}", signable.getClass().getName()); throw ex; }

When it happens

Trigger: Calling verify(SignableXMLObject) with an object that is not an Assertion — e.g. a Response, ArtifactResolve, or custom SignableXMLObject implementation — so the instanceof Assertion branch falls through to the throw.

Common situations: Trying to verify a whole SAML Response's signature instead of the contained assertion; calling verify() on a LogoutRequest when processing SLO; passing an assertion whose signature was stripped during deserialization in other code paths.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

• Unsupported object of type:
• Spring Security does not support OpenSAML {Version.getVersio
• Spring Security does not support OpenSAML {Version.getVersio
• Unsupported object of type:
• Saml2Exception wrapping MarshallingException while re-marsha

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/aea1993bf4b1c8ee. Report an issue: GitHub.