spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping exception during encrypted attribute

Error message

Saml2Exception wrapping exception during encrypted attribute decryption

What it means

decryptAttributes decrypts each EncryptedAttribute in an AttributeStatement; any exception from the Decrypter (not only DecryptionException) is wrapped in Saml2Exception. Thrown because failure to decrypt attributes prevents SP from consuming released attributes.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/metadata/OpenSaml5Template.java:574

								throw new Saml2Exception(ex);
							}
						}
					}
				}
			}
		}

		private void decryptAttributes(AttributeStatement statement) {
			Collection<Attribute> decrypteds = new ArrayList<>();
			for (EncryptedAttribute encrypted : statement.getEncryptedAttributes()) {
				try {
					Attribute decrypted = this.decrypter.decrypt(encrypted);
					if (decrypted != null) {
						decrypteds.add(decrypted);
					}
				}
				catch (Exception ex) {
					throw new Saml2Exception(ex);
				}
			}
			statement.getAttributes().addAll(decrypteds);
		}

		private void decryptSubject(@Nullable Subject subject) {
			if (subject != null) {
				if (subject.getEncryptedID() != null) {
					try {
						NameID decrypted = (NameID) this.decrypter.decrypt(subject.getEncryptedID());
						if (decrypted != null) {
							subject.setNameID(decrypted);
						}
					}
					catch (final DecryptionException ex) {
						throw new Saml2Exception(ex);
					}
				}

View on GitHub (pinned to 96852e8860)

Solutions

Configure the decryption credential matching the IDP's attribute-encryption certificate.
Read the wrapped cause to determine missing-key vs algorithm mismatch and fix accordingly.
Validate the EncryptedAttribute XML structure against the SAML schema.
Coordinate with the IDP to use a supported encryption algorithm/key size.

Example fix

// before
try { Attribute a = decrypter.decrypt(encrypted); }
catch (Exception ex) { /* Saml2Exception here */ }
// after
// ensure credential present first:
Assert.notNull(registration.getDecryptionX509Credentials(), "configure decryption credential");
Attribute a = decrypter.decrypt(encrypted);

Defensive patterns

Strategy: validation

Validate before calling

if (!registration.getDecryptionX509Credentials().isEmpty()) {
    logger.debug("Decryption credentials present; attribute decryption should succeed if cert matches IDP");
}

Try / catch

try {
    template.decrypt(response);
} catch (Saml2Exception ex) {
    logger.error("Attribute decryption failed: {}", ex.getCause() != null ? ex.getCause().getMessage() : ex.getMessage());
}

Prevention

Confirm the IDP's attribute-encryption certificate matches the SP's decryption key.
Coordinate encryption algorithms with the IDP (OpenSAML 5 enforces restrictions).
Validate EncryptedAttribute structure when debugging encrypted SAML responses.

When it happens

Trigger: Calling decrypt(...) on a response/assertion whose AttributeStatement contains an EncryptedAttribute the configured Decrypter cannot decrypt (wrong key, unsupported algorithm, malformed ciphertext).

Common situations: IDP attribute encryption certificate differs from SP's decryption key; missing decryption credentials; OpenSAML 5 restricted encryption algorithms; corrupted base64/cipher data from IDP.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/3347ae120313ec45. Report an issue: GitHub.