spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping DecryptionException during encrypted

Error message

Saml2Exception wrapping DecryptionException during encrypted logout-request NameID decryption

What it means

In the OpenSaml5 decryption configurer's handling of LogoutRequests, an encrypted NameID on the request is decrypted and DecryptionException is wrapped in Saml2Exception. Thrown because a logout request whose NameID cannot be decrypted cannot be correlated to a session, so processing must abort.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java:619

						}
						catch (final DecryptionException ex) {
							throw new Saml2Exception(ex);
						}
					}
				}
			}
		}

		private void decryptLogoutRequest(LogoutRequest request) {
			if (request.getEncryptedID() != null) {
				try {
					NameID decrypted = (NameID) this.decrypter.decrypt(request.getEncryptedID());
					if (decrypted != null) {
						request.setNameID(decrypted);
					}
				}
				catch (DecryptionException ex) {
					throw new Saml2Exception(ex);
				}
			}
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

Configure the SP decryption credential matching the IDP's logout NameID encryption certificate.
Examine the wrapped DecryptionException to distinguish missing key from unsupported algorithm and fix the corresponding side.
Refresh IDP metadata/credentials after any key rotation.
Coordinate with the IDP to either share the correct cert or disable NameID encryption on logout requests.

Example fix

// before
// logout NameID decryption fails: no matching credential
// after
registration = registration.decryptionX509Credentials(c -> c.add(
    new Saml2X509Credential(privateKey, idpEncryptionCert, Saml2X509CredentialType.DECRYPTION)));

Defensive patterns

Strategy: try-catch

Validate before calling

if (request.getEncryptedID() != null && registration.getDecryptionX509Credentials().isEmpty()) {
    throw new IllegalStateException("Encrypted logout NameID but no decryption credentials configured");
}

Try / catch

try {
    // process logout request
} catch (Saml2Exception ex) {
    if (ex.getCause() instanceof DecryptionException) {
        logger.error("Logout NameID decryption failed; IDP/SP key mismatch likely", ex.getCause());
    }
}

Prevention

Configure decryption credentials before enabling SLO with encrypted NameIDs.
Keep IDP and SP encryption keys synchronized after rotation.
Correlate logout failures with IDP certificate changes in monitoring.

When it happens

Trigger: Receiving/processing a SAML LogoutRequest whose EncryptedID fails decryption with the configured Decrypter credentials.

Common situations: IDP encrypts logout NameID with a cert the SP lacks the private key for; SP decryption credentials not configured; IDP key rotation not reflected in SP config; OpenSAML 5 algorithm restriction mismatch.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/d0a1262143ade31c. Report an issue: GitHub.