{"record":{"id":"d0a1262143ade31c","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-decryptionexception-during-d0a126","errorCode":null,"errorMessage":"Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption","messagePattern":"Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java","lineNumber":619,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tprivate void decryptLogoutRequest(LogoutRequest request) {\n\t\t\tif (request.getEncryptedID() != null) {\n\t\t\t\ttry {\n\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());\n\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\trequest.setNameID(decrypted);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcatch (DecryptionException ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":601,"sourceCodeEnd":627,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java#L601-L627","documentation":"In the OpenSaml5 decryption configurer's handling of LogoutRequests, an encrypted NameID on the request is decrypted and DecryptionException is wrapped in Saml2Exception. Thrown because a logout request whose NameID cannot be decrypted cannot be correlated to a session, so processing must abort.","triggerScenarios":"Receiving/processing a SAML LogoutRequest whose EncryptedID fails decryption with the configured Decrypter credentials.","commonSituations":"IDP encrypts logout NameID with a cert the SP lacks the private key for; SP decryption credentials not configured; IDP key rotation not reflected in SP config; OpenSAML 5 algorithm restriction mismatch.","solutions":["Configure the SP decryption credential matching the IDP's logout NameID encryption certificate.","Examine the wrapped DecryptionException to distinguish missing key from unsupported algorithm and fix the corresponding side.","Refresh IDP metadata/credentials after any key rotation.","Coordinate with the IDP to either share the correct cert or disable NameID encryption on logout requests."],"exampleFix":"// before\n// logout NameID decryption fails: no matching credential\n// after\nregistration = registration.decryptionX509Credentials(c -> c.add(\n    new Saml2X509Credential(privateKey, idpEncryptionCert, Saml2X509CredentialType.DECRYPTION)));","handlingStrategy":"try-catch","validationCode":"if (request.getEncryptedID() != null && registration.getDecryptionX509Credentials().isEmpty()) {\n    throw new IllegalStateException(\"Encrypted logout NameID but no decryption credentials configured\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    // process logout request\n} catch (Saml2Exception ex) {\n    if (ex.getCause() instanceof DecryptionException) {\n        logger.error(\"Logout NameID decryption failed; IDP/SP key mismatch likely\", ex.getCause());\n    }\n}","preventionTips":["Configure decryption credentials before enabling SLO with encrypted NameIDs.","Keep IDP and SP encryption keys synchronized after rotation.","Correlate logout failures with IDP certificate changes in monitoring."],"tags":["saml2","decryption","logout","nameid","opensaml5"],"backgroundTag":"missing-credentials","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}