{"record":{"id":"3347ae120313ec45","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-exception-during-encrypted","errorCode":null,"errorMessage":"Saml2Exception wrapping exception during encrypted attribute decryption","messagePattern":"Saml2Exception wrapping exception during encrypted attribute decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java","lineNumber":574,"sourceCode":"\t\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tprivate void decryptAttributes(AttributeStatement statement) {\n\t\t\tCollection<Attribute> decrypteds = new ArrayList<>();\n\t\t\tfor (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {\n\t\t\t\ttry {\n\t\t\t\t\tAttribute decrypted = this.decrypter.decrypt(encrypted);\n\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\tdecrypteds.add(decrypted);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcatch (Exception ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t\tstatement.getAttributes().addAll(decrypteds);\n\t\t}\n\n\t\tprivate void decryptSubject(@Nullable Subject subject) {\n\t\t\tif (subject != null) {\n\t\t\t\tif (subject.getEncryptedID() != null) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());\n\t\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\t\tsubject.setNameID(decrypted);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java#L556-L592","documentation":"decryptAttributes decrypts each EncryptedAttribute in an AttributeStatement; any exception from the Decrypter (not only DecryptionException) is wrapped in Saml2Exception. Thrown because failure to decrypt attributes prevents SP from consuming released attributes.","triggerScenarios":"Calling decrypt(...) on a response/assertion whose AttributeStatement contains an EncryptedAttribute the configured Decrypter cannot decrypt (wrong key, unsupported algorithm, malformed ciphertext).","commonSituations":"IDP attribute encryption certificate differs from SP's decryption key; missing decryption credentials; OpenSAML 5 restricted encryption algorithms; corrupted base64/cipher data from IDP.","solutions":["Configure the decryption credential matching the IDP's attribute-encryption certificate.","Read the wrapped cause to determine missing-key vs algorithm mismatch and fix accordingly.","Validate the EncryptedAttribute XML structure against the SAML schema.","Coordinate with the IDP to use a supported encryption algorithm/key size."],"exampleFix":"// before\ntry { Attribute a = decrypter.decrypt(encrypted); }\ncatch (Exception ex) { /* Saml2Exception here */ }\n// after\n// ensure credential present first:\nAssert.notNull(registration.getDecryptionX509Credentials(), \"configure decryption credential\");\nAttribute a = decrypter.decrypt(encrypted);","handlingStrategy":"validation","validationCode":"if (!registration.getDecryptionX509Credentials().isEmpty()) {\n    logger.debug(\"Decryption credentials present; attribute decryption should succeed if cert matches IDP\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    template.decrypt(response);\n} catch (Saml2Exception ex) {\n    logger.error(\"Attribute decryption failed: {}\", ex.getCause() != null ? ex.getCause().getMessage() : ex.getMessage());\n}","preventionTips":["Confirm the IDP's attribute-encryption certificate matches the SP's decryption key.","Coordinate encryption algorithms with the IDP (OpenSAML 5 enforces restrictions).","Validate EncryptedAttribute structure when debugging encrypted SAML responses."],"tags":["saml2","decryption","attributes","opensaml5"],"backgroundTag":"missing-credentials","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}