Could you explain what the resolution "out of date" for this ticket mean? The code of StaxUtil is unchanged so I'm afraid the issue with it is still there. Or doesn't the Saml2-Authentication-Handler use StaxUtil anymore?