spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping DecryptionException during encrypted

Error message

Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption

What it means

During Single Logout, the encrypted NameID in a <saml2:LogoutRequest> is decrypted (via OpenSaml5DecryptionConfigurer). A DecryptionException is wrapped in a Saml2Exception. This means the LogoutRequest's encrypted identifier could not be decrypted, so the logout principal cannot be determined.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java:619

						}
						catch (final DecryptionException ex) {
							throw new Saml2Exception(ex);
						}
					}
				}
			}
		}

		private void decryptLogoutRequest(LogoutRequest request) {
			if (request.getEncryptedID() != null) {
				try {
					NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
					if (decrypted != null) {
						request.setNameID(decrypted);
					}
				}
				catch (DecryptionException ex) {
					throw new Saml2Exception(ex);
				}
			}
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

Add the matching decryptionX509Credentials to the RelyingPartyRegistration's singleLogout (or default) registration config
Verify the IdP's SLO binding/config encrypts the NameID to the same certificate registered for decryption
If SLO NameID encryption is optional, configure the IdP to send a plain NameID as a workaround
Log the wrapped DecryptionException cause to confirm key vs. algorithm mismatch

Example fix

// before
.singleLogout(sl -> sl.endpoint(...)) // no decryption creds
// after
X509Utilities mtls...;
.singleLogout(sl -> sl.endpoint(...))
// plus registration-level decryptionX509Credentials covering the SLO key

Defensive patterns

Strategy: try-catch

Validate before calling

if (logoutRequest.getEncryptedID() != null
    && registration.getDecryptionX509Credentials().isEmpty())
    throw new IllegalStateException("SLO request carries EncryptedID but no decryption credentials");

Type guard

if (logoutRequest.getNameID() != null || logoutRequest.getEncryptedID() == null) { /* plain NameID present */ }

Try / catch

try {
    // SLO processing
} catch (Saml2Exception ex) {
    if (ex.getCause() instanceof DecryptionException)
        logger.warn("LogoutRequest NameID decryption failed: " + ex.getCause().getMessage());
    throw ex;
}

Prevention

Verify SLO and SSO share the same decryption keys on both sides
Test single logout end-to-end in staging after any key change
If SLO NameID encryption is unnecessary, disable it on the IdP

When it happens

Trigger: Receiving a SAML LogoutRequest at the Single Logout endpoint where getEncryptedID() is present; decryption fails because the SP decryption key does not match the IdP's SLO NameID encryption key.

Common situations: IdP encrypts the NameID in LogoutRequests but the SP's RelyingPartyRegistration only has signing credentials; key rotation between SSO setup and SLO setup; different credentials configured for SSO vs SLO.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/796cfdac19ef5653. Report an issue: GitHub.