spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping exception while signing XMLObject

Error message

Saml2Exception wrapping exception while signing XMLObject

What it means

OpenSaml5Template's serialization configurer sign(O) signs a SignableXMLObject using resolved SignatureSigningParameters; any exception from SignatureSupport.signObject is wrapped in Saml2Exception. This means the cryptographic signing operation failed — bad key, missing signature parameters, or an unsupported algorithm.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/web/OpenSaml5Template.java:252

		OpenSaml5SignatureConfigurer(Collection<Saml2X509Credential> credentials) {
			this.credentials = credentials;
		}

		@Override
		public OpenSaml5SignatureConfigurer algorithms(List<String> algs) {
			this.algs = algs;
			return this;
		}

		@Override
		public <O extends SignableXMLObject> O sign(O object) {
			SignatureSigningParameters parameters = resolveSigningParameters();
			try {
				SignatureSupport.signObject(object, parameters);
			}
			catch (Exception ex) {
				throw new Saml2Exception(ex);
			}
			return object;
		}

		@Override
		public Map<String, String> sign(Map<String, String> params) {
			SignatureSigningParameters parameters = resolveSigningParameters();
			this.components.putAll(params);
			Credential credential = parameters.getSigningCredential();
			Assert.notNull(credential, "credential cannot be null when signing a SAML payload");
			String algorithmUri = parameters.getSignatureAlgorithm();
			Assert.notNull(algorithmUri, "algorithmUri cannot be null when signing a SAML payload");
			this.components.put(Saml2ParameterNames.SIG_ALG, algorithmUri);
			UriComponentsBuilder builder = UriComponentsBuilder.newInstance();
			for (Map.Entry<String, String> component : this.components.entrySet()) {
				builder.queryParam(component.getKey(),
						UriUtils.encode(component.getValue(), StandardCharsets.ISO_8859_1));
			}

View on GitHub (pinned to 96852e8860)

Solutions

1. Inspect the wrapped cause to identify whether the key, algorithm, or parameters are at fault
2. Ensure the signing credential's algorithm is compatible with the configured SignatureSigningParameters (register matching signingConfiguration)
3. Verify the private key is valid, loadable, and its certificate has the digitalSignature key usage
4. Confirm signing credentials are set on the RelyingPartyRegistration before invoking sign()

Example fix

// before
.registration.signingX509Credentials(c -> c.add(cred)) // RSA cert, but EC signing algo configured
.signatureSigningConfiguration(s -> s.signingAlgorithms(a -> a.add(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256)))
// after
.signatureSigningConfiguration(s -> s.signingAlgorithms(a -> a.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256)))

SignatureSigningParameters p = resolveSigningParameters();
if (p.getSigningCredential() == null || p.getSigningCredential().getPrivateKey() == null)
    throw new IllegalStateException("No signing credential resolved");

if (!(object instanceof SignableXMLObject signable) || signable.getSignature() != null) { /* not signable or already signed */ }

try {
    return serializationConfigurer.sign(object);
} catch (Saml2Exception ex) {
    throw new Saml2Exception("XMLObject signing failed: " + ex.getCause(), ex);
}

When it happens

Trigger: Calling sign() on a SignableXMLObject when SignatureSupport.signObject throws: null/invalid signing credential key, signature algorithm mismatch with the key type (e.g. RSA-SHA256 params with an EC key), missing SignatureSigningParameters resolver configuration, or credential incompatibilities.

Common situations: Registering an EC/EdDSA key while relying on default RSA signing parameters; forgetting to configure signature credentials on the RelyingPartyRegistration; certificate key usage lacking digitalSignature; tampering with an object after signature computation started.

Related errors

• Saml2Exception wrapping exception while signing XMLObject
• Saml2Exception wrapping SecurityException while signing quer
• Saml2Exception wrapping exception from signature signing par
• Unable to resolve Builder for
• Unsupported element of type

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/530a242908bc171c. Report an issue: GitHub.