spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping exception during encrypted attribute

Error message

Saml2Exception wrapping exception during encrypted attribute decryption

What it means

decryptAttributes() decrypts each <EncryptedAttribute> in an AttributeStatement; any exception (including DecryptionException and decryption config problems) is caught and rethrown as Saml2Exception. This is the SP failing to recover a plaintext Attribute from the IdP's encrypted attribute element.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java:574

								throw new Saml2Exception(ex);
							}
						}
					}
				}
			}
		}

		private void decryptAttributes(AttributeStatement statement) {
			Collection<Attribute> decrypteds = new ArrayList<>();
			for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
				try {
					Attribute decrypted = this.decrypter.decrypt(encrypted);
					if (decrypted != null) {
						decrypteds.add(decrypted);
					}
				}
				catch (Exception ex) {
					throw new Saml2Exception(ex);
				}
			}
			statement.getAttributes().addAll(decrypteds);
		}

		private void decryptSubject(@Nullable Subject subject) {
			if (subject != null) {
				if (subject.getEncryptedID() != null) {
					try {
						NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
						if (decrypted != null) {
							subject.setNameID(decrypted);
						}
					}
					catch (final DecryptionException ex) {
						throw new Saml2Exception(ex);
					}
				}

View on GitHub (pinned to 96852e8860)

Solutions

Verify the SP's decryption credential (certificate + private key) matches what the IdP uses to encrypt attributes
Configure the decrypter to support the attribute's encryption algorithm
Ask the IdP to disable attribute encryption as a diagnostic step, then re-enable once credentials align
Catch Saml2Exception, log cause, and compare failure against EncryptedAttribute's KeyInfo

Example fix

// before
// only assertion decryption configured
OpenSamlDecryptionConfigurer.withDefaults()
// after
OpenSamlDecryptionConfigurer.withDecryptionCredentials(r -> Set.of(credential))
.withEncryptionAlgorithms(alg -> alg.byKeyTransportAlgorithm("rsa-oaep"))

Defensive patterns

Strategy: try-catch

Validate before calling

if (statement.getEncryptedAttributes() != null && decryptionCredentials.isEmpty()) throw new Saml2ConfigurationException("Encrypted attributes but no decryption credentials configured");

Try / catch

try { template.decrypt(response); } catch (Saml2Exception e) { log.error("Attribute decryption failed", e.getCause()); }

Prevention

Coordinate attribute encryption algorithms with the IdP
Ensure the decrypter is configured for both assertion and attribute decryption
Keep IdP metadata current so encryption certs match

When it happens

Trigger: decryptAssertion() -> decryptAttributes() calling this.decrypter.decrypt(encrypted) for an <EncryptedAttribute> when no matching decryption key exists, the ciphertext is corrupt, or the decrypter was not configured for attribute decryption.

Common situations: IdP sends encrypted attributes but SP registered only assertion decryption credentials; attribute encryption uses an algorithm blocked by JVM crypto policy; truncated/mangled SAML payload from proxy layers.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/f85051c31b2efc33. Report an issue: GitHub.