apereo/cas · error · SamlException

Unable to encrypt assertion for

Error message

Unable to encrypt assertion for 

What it means

When the IdP must encrypt an assertion for an SP but no encrypter can be built (no encryption key/credential resolvable for the SP entity), handleEncryptionFailure throws SamlException unless the service marked encryption as optional. This prevents silently delivering unencrypted assertions where encryption is required.

Solutions

1. Ensure SP metadata publishes an encryption KeyDescriptor with a usable certificate and refresh the cached metadata.
2. Set service.setEncryptionOptional(true) if delivering unencrypted assertions is acceptable per policy.
3. Configure the service's encryption parameters (algorithm, key size, fingerprint) to match what the SP supports.
4. Verify the correct entityID is being used to look up SP encryption credentials.

Example fix

// before
registeredService.setEncryptionOptional(false); // SP has no encryption cert
// after
registeredService.setEncryptionOptional(true); // or publish encryption cert in SP metadata

val encryptionCerts = metadataResolver.getEncryptionCertificates(entityId, service);
if ((encryptionCerts == null || encryptionCerts.isEmpty()) && !service.isEncryptionOptional())
    LOGGER.error("SP [{}] publishes no encryption certificate; encryption will fail", entityId);

boolean spSupportsEncryption(SamlRegisteredService s, String entityId) {
    return s.isEncryptionOptional() || !getEncryptionCredentials(entityId).isEmpty();
}

try {
    val encoded = encrypter.encode(assertion, service, adaptor, ...);
} catch (SamlException e) {
    LOGGER.error("Cannot encrypt assertion for [{}]: update SP metadata or mark encryption optional", adaptor.getEntityId());
}

When it happens

Trigger: encode()/buildEncrypterForSamlObject fails to resolve SP encryption credentials (e.g. SP metadata lacks KeyDescriptor use=encryption, or no certificate found) and handleEncryptionFailure runs with service.isEncryptionOptional()==false.

Common situations: SP metadata contains only a signing certificate, not an encryption certificate; SP certificate expired/removed from metadata; encryption key size mismatch (SP can't accept the algorithm) surfaced as no usable encrypter; service misconfigured with encryption required though SP doesn't support it.

Related errors

• Unable to resolve the encryption [public] key for entity id
• Unable to resolve the encryption [public] key for entity id
• No assertion consumer service could be found for entity
• Endpoint for is not available or does not define a binding…
• Endpoint for does not define a binding or location for…

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/1bd886096930059b. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-saml-idp-web/src/main/java/org/apereo/cas/support/saml/web/idp/profile/builders/enc/SamlIdPObjectEncrypter.java:82

/**
 * This is {@link SamlIdPObjectEncrypter}.
 *
 * @author Misagh Moayyed
 * @since 5.0.0
 */
@Slf4j
@RequiredArgsConstructor
public class SamlIdPObjectEncrypter {
    private final SamlIdPProperties samlIdPProperties;

    private final SamlIdPMetadataLocator samlIdPMetadataLocator;

    private static void handleEncryptionFailure(final SamlRegisteredService service,
                                                final SamlRegisteredServiceMetadataAdaptor adaptor) {
        val entityId = adaptor.getEntityId();
        if (!service.isEncryptionOptional()) {
            throw new SamlException("Unable to encrypt assertion for " + entityId);
        }
        LOGGER.debug("Skipping to encrypt; No encrypter can be determined and encryption is optional for [{}]", entityId);
    }

    /**
     * Encode a given saml object by invoking a number of outbound security handlers on the context.
     *
     * @param samlObject the saml object
     * @param service    the service
     * @param adaptor    the adaptor
     * @return the t
     */
    public EncryptedAssertion encode(final Assertion samlObject,
                                     final SamlRegisteredService service,
                                     final SamlRegisteredServiceMetadataAdaptor adaptor) {

        try {
            val encrypter = buildEncrypterForSamlObject(samlObject, service, adaptor);

View on GitHub (pinned to e7288fc434)