{"record":{"id":"f85051c31b2efc33","repo":"spring-projects/spring-security","slug":"saml2exception-wrapping-exception-during-encrypted-f85051","errorCode":null,"errorMessage":"Saml2Exception wrapping exception during encrypted attribute decryption","messagePattern":"Saml2Exception wrapping exception during encrypted attribute decryption","errorType":"exception","errorClass":"Saml2Exception","httpStatus":null,"severity":"error","filePath":"saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java","lineNumber":574,"sourceCode":"\t\t\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tprivate void decryptAttributes(AttributeStatement statement) {\n\t\t\tCollection<Attribute> decrypteds = new ArrayList<>();\n\t\t\tfor (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {\n\t\t\t\ttry {\n\t\t\t\t\tAttribute decrypted = this.decrypter.decrypt(encrypted);\n\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\tdecrypteds.add(decrypted);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcatch (Exception ex) {\n\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t}\n\t\t\t}\n\t\t\tstatement.getAttributes().addAll(decrypteds);\n\t\t}\n\n\t\tprivate void decryptSubject(@Nullable Subject subject) {\n\t\t\tif (subject != null) {\n\t\t\t\tif (subject.getEncryptedID() != null) {\n\t\t\t\t\ttry {\n\t\t\t\t\t\tNameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());\n\t\t\t\t\t\tif (decrypted != null) {\n\t\t\t\t\t\t\tsubject.setNameID(decrypted);\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t\tcatch (final DecryptionException ex) {\n\t\t\t\t\t\tthrow new Saml2Exception(ex);\n\t\t\t\t\t}\n\t\t\t\t}","sourceCodeStart":556,"sourceCodeEnd":592,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java#L556-L592","documentation":"decryptAttributes() decrypts each <EncryptedAttribute> in an AttributeStatement; any exception (including DecryptionException and decryption config problems) is caught and rethrown as Saml2Exception. This is the SP failing to recover a plaintext Attribute from the IdP's encrypted attribute element.","triggerScenarios":"decryptAssertion() -> decryptAttributes() calling this.decrypter.decrypt(encrypted) for an <EncryptedAttribute> when no matching decryption key exists, the ciphertext is corrupt, or the decrypter was not configured for attribute decryption.","commonSituations":"IdP sends encrypted attributes but SP registered only assertion decryption credentials; attribute encryption uses an algorithm blocked by JVM crypto policy; truncated/mangled SAML payload from proxy layers.","solutions":["Verify the SP's decryption credential (certificate + private key) matches what the IdP uses to encrypt attributes","Configure the decrypter to support the attribute's encryption algorithm","Ask the IdP to disable attribute encryption as a diagnostic step, then re-enable once credentials align","Catch Saml2Exception, log cause, and compare failure against EncryptedAttribute's KeyInfo"],"exampleFix":"// before\n// only assertion decryption configured\nOpenSamlDecryptionConfigurer.withDefaults()\n// after\nOpenSamlDecryptionConfigurer.withDecryptionCredentials(r -> Set.of(credential))\n.withEncryptionAlgorithms(alg -> alg.byKeyTransportAlgorithm(\"rsa-oaep\"))","handlingStrategy":"try-catch","validationCode":"if (statement.getEncryptedAttributes() != null && decryptionCredentials.isEmpty()) throw new Saml2ConfigurationException(\"Encrypted attributes but no decryption credentials configured\");","typeGuard":null,"tryCatchPattern":"try { template.decrypt(response); } catch (Saml2Exception e) { log.error(\"Attribute decryption failed\", e.getCause()); }","preventionTips":["Coordinate attribute encryption algorithms with the IdP","Ensure the decrypter is configured for both assertion and attribute decryption","Keep IdP metadata current so encryption certs match"],"tags":["saml","decryption","attributes","spring-security"],"backgroundTag":"decryption-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}