twentyhq/twenty · error · Error

X509Data element is missing

Error message

X509Data element is missing

What it means

Thrown when <KeyInfo> was found but contains no <X509Data> sub-element. X509Data is the specific XMLDSig container that wraps the <X509Certificate>; the parser does not accept alternative key representations like RSAKeyValue or KeyValue.

Source

Thrown at packages/twenty-front/src/modules/settings/security/utils/parseSAMLMetadataFromXMLFile.ts:88

      throw new Error('File is not valid XML');
    }

    const entityDescriptor = getByPrefixAndKey(xmlDoc, 'EntityDescriptor');
    if (!entityDescriptor)
      throw new Error('EntityDescriptor element is missing');

    const IDPSSODescriptor = getByPrefixAndKey(xmlDoc, 'IDPSSODescriptor');
    if (!IDPSSODescriptor)
      throw new Error('IDPSSODescriptor element is missing');

    const keyDescriptors = getByPrefixAndKey(IDPSSODescriptor, 'KeyDescriptor');
    if (!keyDescriptors) throw new Error('KeyDescriptor element is missing');

    const keyInfo = getByPrefixAndKey(keyDescriptors, 'KeyInfo');
    if (!keyInfo) throw new Error('KeyInfo element is missing');

    const x509Data = getByPrefixAndKey(keyInfo, 'X509Data');
    if (!x509Data) throw new Error('X509Data element is missing');

    const x509Certificate = getByPrefixAndKey(
      x509Data,
      'X509Certificate',
    )?.textContent?.trim();
    if (!x509Certificate)
      throw new Error('X509Certificate is missing or empty');

    const singleSignOnServices = getAllByPrefixAndKey(
      IDPSSODescriptor,
      'SingleSignOnService',
    ).map((service) => ({
      binding: service.getAttribute('Binding'),
      location: service.getAttribute('Location'),
    }));

    // Prefer HTTP-Redirect (the default authnRequestBinding on the SP side),
    // fall back to HTTP-POST since both are valid SAML 2.0 bindings and many

View on GitHub (pinned to 1f5dd2bbd2)

Solutions

1. Open the XML and confirm <X509Data> exists inside <KeyInfo>.
2. If the IdP only publishes RSAKeyValue, reconfigure the IdP to export the X.509 certificate form.
3. Verify the X509Data namespace prefix is one of md/ns0/ns2/dsig/ds, or extend allPrefix.

Example fix

// before: <ds:KeyInfo><ds:KeyValue><ds:RSAKeyValue>...</ds:RSAKeyValue></ds:KeyValue></ds:KeyInfo>
// after:  <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIID...</ds:X509Certificate></ds:X509Data></ds:KeyInfo>

const hasX509Data = (xml: string): boolean => /<[^>]*X509Data[\s\S]*?<\/[^>]*X509Data>/.test(xml) || /<[^>]*X509Data[^>]*\/>/.test(xml) === false && /<[^>]*X509Data[\s>]/.test(xml);

const keyInfoHasX509 = (keyInfoEl: Element): boolean =>
  ['md','ns0','ns2','dsig','ds',''].some((p) =>
    keyInfoEl.getElementsByTagName(p ? `${p}:X509Data` : 'X509Data').length > 0);

const res = parseSAMLMetadataFromXMLFile(xml);
if (!res.success && res.reason.includes('X509Data')) {
  notifyUser('IdP metadata must publish an X.509 certificate, not a raw public key');
  return;
}

When it happens

Trigger: KeyInfo holds a <KeyValue>/<RSAKeyValue> instead of <X509Data>, or X509Data uses an unrecognized namespace prefix. IdP publishes a raw public key rather than an X.509 certificate.

Common situations: IdP configured to emit raw RSA keys. Metadata produced by a non-standard SAML library. Namespace prefix on X509Data is not in the md/ns0/ns2/dsig/ds allowlist.

Related errors

• KeyDescriptor element is missing
• KeyInfo element is missing
• X509Certificate is missing or empty
• No SingleSignOnService with HTTP-Redirect or HTTP-POST bindi
• File is not valid XML

AI-assisted analysis of twentyhq/twenty@1f5dd2bbd2 (2026-08-12). Data as JSON: /api/errors/c945b65d3b62eed2. Report an issue: GitHub.