by changing version of saml2-core we can remove the xml-api dependency, it was fixed in a commit https://github.com/SpringSource/spring-security-saml/commit/d29a1c7e8d481d8e198d04050bbc1139c184c1f7 and reference https://jira.springsource.org/browse/SES-125