{"record":{"id":"796cfdac19ef5653","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-decryptionexception-during-796cfd","errorCode":null,"errorMessage":"Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption","messagePattern":"Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java","lineNumber":619,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tprivate void decryptLogoutRequest(LogoutRequest request) {\n\t\t\tif (request.getEncryptedID() != null) {\n\t\t\t\ttry {\n\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());\n\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\trequest.setNameID(decrypted);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcatch (DecryptionException ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":601,"sourceCodeEnd":627,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java#L601-L627","documentation":"During Single Logout, the encrypted NameID in a <saml2:LogoutRequest> is decrypted (via OpenSaml5DecryptionConfigurer). A DecryptionException is wrapped in a Saml2Exception. This means the LogoutRequest's encrypted identifier could not be decrypted, so the logout principal cannot be determined.","triggerScenarios":"Receiving a SAML LogoutRequest at the Single Logout endpoint where getEncryptedID() is present; decryption fails because the SP decryption key does not match the IdP's SLO NameID encryption key.","commonSituations":"IdP encrypts the NameID in LogoutRequests but the SP's RelyingPartyRegistration only has signing credentials; key rotation between SSO setup and SLO setup; different credentials configured for SSO vs SLO.","solutions":["Add the matching decryptionX509Credentials to the RelyingPartyRegistration's singleLogout (or default) registration config","Verify the IdP's SLO binding/config encrypts the NameID to the same certificate registered for decryption","If SLO NameID encryption is optional, configure the IdP to send a plain NameID as a workaround","Log the wrapped DecryptionException cause to confirm key vs. algorithm mismatch"],"exampleFix":"// before\n.singleLogout(sl -> sl.endpoint(...)) // no decryption creds\n// after\nX509Utilities mtls...;\n.singleLogout(sl -> sl.endpoint(...))\n// plus registration-level decryptionX509Credentials covering the SLO key","handlingStrategy":"try-catch","validationCode":"if (logoutRequest.getEncryptedID() != null\n    && registration.getDecryptionX509Credentials().isEmpty())\n    throw new IllegalStateException(\"SLO request carries EncryptedID but no decryption credentials\");","typeGuard":"if (logoutRequest.getNameID() != null || logoutRequest.getEncryptedID() == null) { /* plain NameID present */ }","tryCatchPattern":"try {\n    // SLO processing\n} catch (Saml2Exception ex) {\n    if (ex.getCause() instanceof DecryptionException)\n        logger.warn(\"LogoutRequest NameID decryption failed: \" + ex.getCause().getMessage());\n    throw ex;\n}","preventionTips":["Verify SLO and SSO share the same decryption keys on both sides","Test single logout end-to-end in staging after any key change","If SLO NameID encryption is unnecessary, disable it on the IdP"],"tags":["saml2","decryption","single-logout","logout-request","spring-security"],"backgroundTag":"saml-decryption-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}