spring-projects/spring-security · error · Saml2Exception

Saml2Exception wrapping SecurityException while signing quer

Error message

Saml2Exception wrapping SecurityException while signing query string (redirect binding)

What it means

The redirect-binding sign(Map) variant signs the raw query string with XMLSigningUtil.signWithURI using the resolved signing credential; OpenSAML SecurityException from that operation is wrapped in this Saml2Exception. It means the HTTP-Redirect signature computation failed, almost always due to a credential/key problem.

Source

Thrown at saml2/saml2-service-provider/src/opensaml5Main/java/org/springframework/security/saml2/provider/service/registration/OpenSaml5Template.java:279

			Credential credential = parameters.getSigningCredential();
			Assert.notNull(credential, "credential cannot be null when signing a SAML payload");
			String algorithmUri = parameters.getSignatureAlgorithm();
			Assert.notNull(algorithmUri, "algorithmUri cannot be null when signing a SAML payload");
			this.components.put(Saml2ParameterNames.SIG_ALG, algorithmUri);
			UriComponentsBuilder builder = UriComponentsBuilder.newInstance();
			for (Map.Entry<String, String> component : this.components.entrySet()) {
				builder.queryParam(component.getKey(),
						UriUtils.encode(component.getValue(), StandardCharsets.ISO_8859_1));
			}
			String queryString = builder.build(true).toString().substring(1);
			try {
				byte[] rawSignature = XMLSigningUtil.signWithURI(credential, algorithmUri,
						queryString.getBytes(StandardCharsets.UTF_8));
				String b64Signature = Saml2Utils.samlEncode(rawSignature);
				this.components.put(Saml2ParameterNames.SIGNATURE, b64Signature);
			}
			catch (SecurityException ex) {
				throw new Saml2Exception(ex);
			}
			return this.components;
		}

		private SignatureSigningParameters resolveSigningParameters() {
			List<Credential> credentials = resolveSigningCredentials();
			List<String> digests = Collections.singletonList(SignatureConstants.ALGO_ID_DIGEST_SHA256);
			String canonicalization = SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS;
			SignatureSigningParametersResolver resolver = new SAMLMetadataSignatureSigningParametersResolver();
			BasicSignatureSigningConfiguration signingConfiguration = new BasicSignatureSigningConfiguration();
			signingConfiguration.setSigningCredentials(credentials);
			signingConfiguration.setSignatureAlgorithms(this.algs);
			signingConfiguration.setSignatureReferenceDigestMethods(digests);
			signingConfiguration.setSignatureCanonicalizationAlgorithm(canonicalization);
			signingConfiguration.setKeyInfoGeneratorManager(buildSignatureKeyInfoGeneratorManager());
			CriteriaSet criteria = new CriteriaSet(new SignatureSigningConfigurationCriterion(signingConfiguration));
			try {
				SignatureSigningParameters parameters = resolver.resolveSingle(criteria);

View on GitHub (pinned to 96852e8860)

Solutions

  1. Check ex.getCause() for the underlying SecurityException detail (key type, algorithm, provider)
  2. Ensure the signing credential includes a usable private key matching the configured signature algorithm (RSA key with RSA-SHA256, EC key with ECDSA-SHA256, etc.)
  3. Verify the keystore/HSM is accessible at runtime and the key password is correct
  4. Log the resolved SignatureSigningParameters (algorithm + credential type) to confirm a coherent combination

Example fix

// before
.sign("http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256") // EC algorithm with RSA key
// after
.sign(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256); // match algorithm to the RSA private key
Defensive patterns

Strategy: try-catch

Validate before calling

Assert.notNull(privateKey, "Redirect binding signing requires a private key");
// key/algorithm compatibility
Assert.isTrue(rsaKey || ecKeyMatchesAlgorithm, "Signature algorithm does not match key type");

Try / catch

try {
    Map<String, String> params = template.sign(queryParams);
} catch (Saml2Exception ex) {
    logger.error("Redirect-binding signing failed: " + ex.getCause(), ex);
    throw ex;
}

Prevention

When it happens

Trigger: Building a signed redirect-binding URL (e.g. SAML logout/AuthnRequest redirects) when the credential cannot produce an RSA/EC signature: credential has no private key, key algorithm doesn't match the resolved signatureAlgorithmUri, or crypto provider rejects the operation.

Common situations: Delegated logout redirects with a certificate that lacks the private key; mismatch between configured signing algorithm (e.g. ECDSA) and an RSA key; HSM/PKCS11 provider unavailable so key access fails at sign time.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/56889f43951bde8e. Report an issue: GitHub.