{"record":{"id":"0a3ac66b8909ac12","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-decryptionexception-during-0a3ac6","errorCode":null,"errorMessage":"Saml2Exception wrapping DecryptionException during encrypted subject NameID decryption","messagePattern":"Saml2Exception wrapping DecryptionException during encrypted subject NameID decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java","lineNumber":590,"sourceCode":"\t\t\t\t}\n\t\t\t\tcatch (Exception ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t\tstatement.getAttributes().addAll(decrypteds);\n\t\t}\n\n\t\tprivate void decryptSubject(@Nullable Subject subject) {\n\t\t\tif (subject != null) {\n\t\t\t\tif (subject.getEncryptedID() != null) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());\n\t\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\t\tsubject.setNameID(decrypted);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tfor (final SubjectConfirmation sc : subject.getSubjectConfirmations()) {\n\t\t\t\t\tif (sc.getEncryptedID() != null) {\n\t\t\t\t\t\ttry {\n\t\t\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(sc.getEncryptedID());\n\t\t\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\t\t\tsc.setNameID(decrypted);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}","sourceCodeStart":572,"sourceCodeEnd":608,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java#L572-L608","documentation":"decryptSubject decrypts an encrypted NameID on the Assertion's Subject; DecryptionException is wrapped in Saml2Exception. Thrown because the subject's NameID cannot be resolved without successful decryption, which would break downstream identity mapping.","triggerScenarios":"Calling decrypt(...) where subject.getEncryptedID() exists but cannot be decrypted with the configured Decrypter credentials.","commonSituations":"Missing/mismatched decryption key after IDP cert rotation; IDP encrypts NameID with different key than assertions; algorithm restrictions in OpenSAML 5; SP credential never configured.","solutions":["Add/refresh the SP decryption credential that matches the IDP's NameID encryption certificate.","Check the wrapped DecryptionException cause for 'no key info' vs 'unsupported algorithm'.","Synchronize IDP metadata after key rotation so the SP has the current certificate.","If the IDP supports it, disable NameID encryption or align it with assertion encryption keys."],"exampleFix":"// before\nhttp.saml2Login(relyingPartyRegistrations -> relyingPartyRegistrations.registration(reg)); // reg lacks decryption key\n// after\nreg = RelyingPartyRegistration.withRelyingPartyRegistration(reg)\n    .decryptionX509Credentials(c -> c.add(decryptCredential))\n    .build();","handlingStrategy":"validation","validationCode":"Assert.notEmpty(registration.getDecryptionX509Credentials(), \"configure decryption credential before processing encrypted subjects\");","typeGuard":null,"tryCatchPattern":"try {\n    template.decrypt(response);\n} catch (Saml2Exception ex) {\n    if (ex.getCause() instanceof DecryptionException) {\n        logger.error(\"Subject NameID decryption failed; check decryption key\", ex.getCause());\n    }\n}","preventionTips":["Use the same decryption key as advertised in SP metadata for NameID encryption.","Monitor for IDP certificate rotations and update credentials promptly.","Prefer disabling NameID encryption on the IDP if not strictly required."],"tags":["saml2","decryption","subject","nameid","opensaml5"],"backgroundTag":"missing-credentials","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}