{"record":{"id":"530a242908bc171c","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-exception-while-signing-xm-530a24","errorCode":null,"errorMessage":"Saml2Exception wrapping exception while signing XMLObject","messagePattern":"Saml2Exception wrapping exception while signing XMLObject","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java","lineNumber":252,"sourceCode":"\n\t\tOpenSaml5SignatureConfigurer(Collection<Saml2X509Credential> credentials) {\n\t\t\tthis.credentials = credentials;\n\t\t}\n\n\t\t@Override\n\t\tpublic OpenSaml5SignatureConfigurer algorithms(List<String> algs) {\n\t\t\tthis.algs = algs;\n\t\t\treturn this;\n\t\t}\n\n\t\t@Override\n\t\tpublic <O extends SignableXMLObject> O sign(O object) {\n\t\t\tSignatureSigningParameters parameters = resolveSigningParameters();\n\t\t\ttry {\n\t\t\t\tSignatureSupport.signObject(object, parameters);\n\t\t\t}\n\t\t\tcatch (Exception ex) {\n\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t}\n\t\t\treturn object;\n\t\t}\n\n\t\t@Override\n\t\tpublic Map<String, String> sign(Map<String, String> params) {\n\t\t\tSignatureSigningParameters parameters = resolveSigningParameters();\n\t\t\tthis.components.putAll(params);\n\t\t\tCredential credential = parameters.getSigningCredential();\n\t\t\tAssert.notNull(credential, \"credential cannot be null when signing a SAML payload\");\n\t\t\tString algorithmUri = parameters.getSignatureAlgorithm();\n\t\t\tAssert.notNull(algorithmUri, \"algorithmUri cannot be null when signing a SAML payload\");\n\t\t\tthis.components.put(Saml2ParameterNames.SIG_ALG, algorithmUri);\n\t\t\tUriComponentsBuilder builder = UriComponentsBuilder.newInstance();\n\t\t\tfor (Map.Entry<String, String> component : this.components.entrySet()) {\n\t\t\t\tbuilder.queryParam(component.getKey(),\n\t\t\t\t\t\tUriUtils.encode(component.getValue(), StandardCharsets.ISO_8859_1));\n\t\t\t}","sourceCodeStart":234,"sourceCodeEnd":270,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java#L234-L270","documentation":"OpenSaml5Template's serialization configurer sign(O) signs a SignableXMLObject using resolved SignatureSigningParameters; any exception from SignatureSupport.signObject is wrapped in Saml2Exception. This means the cryptographic signing operation failed — bad key, missing signature parameters, or an unsupported algorithm.","triggerScenarios":"Calling sign() on a SignableXMLObject when SignatureSupport.signObject throws: null/invalid signing credential key, signature algorithm mismatch with the key type (e.g. RSA-SHA256 params with an EC key), missing SignatureSigningParameters resolver configuration, or credential incompatibilities.","commonSituations":"Registering an EC/EdDSA key while relying on default RSA signing parameters; forgetting to configure signature credentials on the RelyingPartyRegistration; certificate key usage lacking digitalSignature; tampering with an object after signature computation started.","solutions":["Inspect the wrapped cause to identify whether the key, algorithm, or parameters are at fault","Ensure the signing credential's algorithm is compatible with the configured SignatureSigningParameters (register matching signingConfiguration)","Verify the private key is valid, loadable, and its certificate has the digitalSignature key usage","Confirm signing credentials are set on the RelyingPartyRegistration before invoking sign()"],"exampleFix":"// before\n.registration.signingX509Credentials(c -> c.add(cred)) // RSA cert, but EC signing algo configured\n.signatureSigningConfiguration(s -> s.signingAlgorithms(a -> a.add(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256)))\n// after\n.signatureSigningConfiguration(s -> s.signingAlgorithms(a -> a.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256)))","handlingStrategy":"try-catch","validationCode":"SignatureSigningParameters p = resolveSigningParameters();\nif (p.getSigningCredential() == null || p.getSigningCredential().getPrivateKey() == null)\n    throw new IllegalStateException(\"No signing credential resolved\");","typeGuard":"if (!(object instanceof SignableXMLObject signable) || signable.getSignature() != null) { /* not signable or already signed */ }","tryCatchPattern":"try {\n    return serializationConfigurer.sign(object);\n} catch (Saml2Exception ex) {\n    throw new Saml2Exception(\"XMLObject signing failed: \" + ex.getCause(), ex);\n}","preventionTips":["Match signature algorithms to the credential key type (RSA vs EC vs EdDSA)","Verify certificate key usage includes digitalSignature","Configure signing credentials on the RelyingPartyRegistration before signing","Log the wrapped cause to pinpoint parameter vs. key failures"],"tags":["saml2","signing","signature","opensaml","spring-security"],"backgroundTag":"xml-signing-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}