twentyhq/twenty · warning · Error

IDPSSODescriptor element is missing

Error message

IDPSSODescriptor element is missing

What it means

Thrown by parseSAMLMetadataFromXMLFile (parseSAMLMetadataFromXMLFile.ts:77-79) when EntityDescriptor exists but contains no IDPSSODescriptor element (searched across supported namespace prefixes and unprefixed). IDPSSODescriptor describes the IdP's SSO capabilities and is required to extract SingleSignOnService URLs and signing certificates. Caught at line 127 and returned as `{ success: false, reason: 'IDPSSODescriptor element is missing' }`.

Source

Thrown at packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts:79

export const parseSAMLMetadataFromXMLFile = (
  xmlString: string,
):
  | { success: true; data: z.infer<typeof validator> }
  | { success: false; reason: string } => {
  try {
    const parser = new DOMParser();
    const xmlDoc = parser.parseFromString(xmlString, 'application/xml');
    if (xmlDoc.getElementsByTagName('parsererror').length > 0) {
      throw new Error('File is not valid XML');
    }

    const entityDescriptor = getByPrefixAndKey(xmlDoc, 'EntityDescriptor');
    if (!entityDescriptor)
      throw new Error('EntityDescriptor element is missing');

    const IDPSSODescriptor = getByPrefixAndKey(xmlDoc, 'IDPSSODescriptor');
    if (!IDPSSODescriptor)
      throw new Error('IDPSSODescriptor element is missing');

    const keyDescriptors = getByPrefixAndKey(IDPSSODescriptor, 'KeyDescriptor');
    if (!keyDescriptors) throw new Error('KeyDescriptor element is missing');

    const keyInfo = getByPrefixAndKey(keyDescriptors, 'KeyInfo');
    if (!keyInfo) throw new Error('KeyInfo element is missing');

    const x509Data = getByPrefixAndKey(keyInfo, 'X509Data');
    if (!x509Data) throw new Error('X509Data element is missing');

    const x509Certificate = getByPrefixAndKey(
      x509Data,
      'X509Certificate',
    )?.textContent?.trim();
    if (!x509Certificate)
      throw new Error('X509Certificate is missing or empty');

    const singleSignOnServices = getAllByPrefixAndKey(

View on GitHub (pinned to 1f5dd2bbd2)

Solutions

  1. Obtain IdP metadata that includes IDPSSODescriptor (not SP metadata).
  2. Download metadata directly from the IdP's well-known URL (e.g. /idp/metadata/adapter).
  3. Confirm with the IdP admin that the metadata describes the IdP role.
  4. Inspect the XML to verify the role descriptor element name.
Defensive patterns

Strategy: validation

Validate before calling

// Pre-check for IDPSSODescriptor before parsing
const doc = new DOMParser().parseFromString(xmlString, 'application/xml');
const hasIdpSsoDescriptor =
  ['md', 'ns0', 'ns2', 'dsig', 'ds', '']
    .some((p) => doc.getElementsByTagName(p ? `${p}:IDPSSODescriptor` : 'IDPSSODescriptor').length > 0);
if (!hasIdpSsoDescriptor) {
  setFormError(t`Metadata must describe an Identity Provider (IDPSSODescriptor)`);
}

Type guard

const hasIdpSsoDescriptor = (s: string): boolean => {
  const doc = new DOMParser().parseFromString(s, 'application/xml');
  return ['md', 'ns0', 'ns2', 'dsig', 'ds', '']
    .some((p) => doc.getElementsByTagName(p ? `${p}:IDPSSODescriptor` : 'IDPSSODescriptor').length > 0);
};

Try / catch

// Parser returns { success: false, reason } — handle accordingly
const result = parseSAMLMetadataFromXMLFile(xmlString);
if (!result.success && result.reason === 'IDPSSODescriptor element is missing') {
  setFormError(t`Upload IdP metadata (not SP metadata)`);
}

Prevention

When it happens

Trigger: Uploaded XML has EntityDescriptor but no IDPSSODescriptor — e.g. metadata for a service provider (which uses SPSSODescriptor), an attribute authority (AttributeAuthorityDescriptor), or a SAML entity role other than IdP.

Common situations: Uploading SP metadata instead of IdP metadata; the IdP metadata file only contains AttributeAuthorityDescriptor; partial metadata export missing the role descriptor; metadata for a different federation role.

Related errors

AI-assisted analysis of twentyhq/twenty@1f5dd2bbd2 (2026-08-12). Data as JSON: /api/errors/c8dd0e7918e69cf0. Report an issue: GitHub.