{"record":{"id":"70d3cd27f4b509fb","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-exception-during-encrypted-70d3cd","errorCode":null,"errorMessage":"Saml2Exception wrapping exception during encrypted attribute decryption","messagePattern":"Saml2Exception wrapping exception during encrypted attribute decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java","lineNumber":574,"sourceCode":"\t\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tprivate void decryptAttributes(AttributeStatement statement) {\n\t\t\tCollection<Attribute> decrypteds = new ArrayList<>();\n\t\t\tfor (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {\n\t\t\t\ttry {\n\t\t\t\t\tAttribute decrypted = this.decrypter.decrypt(encrypted);\n\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\tdecrypteds.add(decrypted);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcatch (Exception ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t\tstatement.getAttributes().addAll(decrypteds);\n\t\t}\n\n\t\tprivate void decryptSubject(@Nullable Subject subject) {\n\t\t\tif (subject != null) {\n\t\t\t\tif (subject.getEncryptedID() != null) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());\n\t\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\t\tsubject.setNameID(decrypted);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java#L556-L592","documentation":"OpenSaml5Template.decryptAttributes decrypts encrypted <saml2:Attribute> values in an AttributeStatement. Any exception (typically DecryptionException) thrown by the OpenSAML Decrypter is wrapped in a Saml2Exception and rethrown. This means an encrypted attribute could not be decrypted with the available credentials.","triggerScenarios":"decryptAssertion -> decryptAttributes invoked on a Response whose AttributeStatement contains <saml2:EncryptedAttribute>; decryption key mismatch, unsupported encryption algorithm, or malformed encrypted data causes the underlying exception.","commonSituations":"IdP configured to encrypt attributes with a certificate the SP has not registered; SP registration matched by issuer with only a signing key present; IdP changed encryption algorithms (e.g. AES-256-GCM) unsupported by the JVM's crypto providers.","solutions":["Register the correct decryptionX509Credentials (private key matching the IdP's attribute-encryption certificate) on the RelyingPartyRegistration","Compare the EncryptedAttribute's KeyInfo/X509 certificate with the registered decryption certificates","Ensure the JVM supports the encryption/key-transport algorithm used (install JCE providers if needed)","Ask the IdP to send attributes unencrypted if decryption keys cannot be shared"],"exampleFix":"// before\n.registration.decryptionX509Credentials(c -> c.add(signingCertCred)) // signing only\n// after\n.registration.decryptionX509Credentials(c -> c.add(new Saml2X509Credential.PrivateKey(\n    RSAPrivateCrtKey, decryptionCert)))","handlingStrategy":"try-catch","validationCode":"boolean hasEncryptedAttrs = statement.getAttributes().stream()\n    .anyMatch(a -> a instanceof EncryptedAttribute);\nif (hasEncryptedAttrs && registration.getDecryptionX509Credentials().isEmpty())\n    throw new IllegalStateException(\"Encrypted attributes present but no decryption credentials\");","typeGuard":"if (attribute instanceof EncryptedAttribute enc) { /* needs decryption */ } else { /* plain attribute */ }","tryCatchPattern":"try {\n    attributes = template.decryptAttributes(...);\n} catch (Saml2Exception ex) {\n    logger.warn(\"Attribute decryption failed: \" + ex.getCause());\n    throw ex;\n}","preventionTips":["Match attribute-encryption certs in IdP config with SP decryption credentials","Confirm JVM crypto providers support the IdP's attribute encryption algorithm","Ask IdP admins which certificate they encrypt attributes to and import exactly that one"],"tags":["saml2","decryption","attributes","spring-security"],"backgroundTag":"saml-decryption-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}