title: Spring SAML: Error decrypting encrypted key, No installed provider supports this key
body: <p>I have refered the Spring SAML manual to create private key and import public certificate. But I am still facing issues with the encryption/decryption.</p>
  
  <p>I have created a JKS file with the following commands as mentioned in the manual which are as follows </p>
  
  <p>Command used to Import public certificate of IDP</p>
  
  <pre><code>keytool -importcert -alias adfssigning -keystore samlKeystore.jks -file testIdp.cer
  </code></pre>
  
  <p>Command used for Private Key</p>
  
  <pre><code>keytool -genkeypair -alias myprivatealias -keypass changeit -keystore samlKeystore.jks
  </code></pre>
  
  <p>Passwords of both private key and keystore is defined as 'changeit'</p>
  
  <p>I have configured the securityContext as follows</p>
  
  <pre><code>&lt;bean id="keyManager" class="org.springframework.security.saml.key.JKSKeyManager"&gt;
      &lt;constructor-arg value="classpath:security/samlKeystore.jks"/&gt;
      &lt;constructor-arg type="java.lang.String" value="changeit"/&gt;
      &lt;constructor-arg&gt;
          &lt;map&gt;
              &lt;entry key="myprivatealias" value="changeit"/&gt;
          &lt;/map&gt;
      &lt;/constructor-arg&gt;
      &lt;constructor-arg type="java.lang.String" value="myprivatealias"/&gt;
  &lt;/bean&gt;
  </code></pre>
  
  <p>I am able to see the idpDiscovery page where I can select the IDP. I am able to view the login page of the IDP as well. But when I provide the user credentials, I am getting the following exception.</p>
  
  <p><strong>This exception is occuring when saml2:EncryptedAssertion is sent along with the saml2p:Status in the SAML response</strong>. (Class: WebSSOProfileConsumerImpl of spring-saml jar)</p>
  
  <pre><code>ERROR org.opensaml.xml.encryption.Decrypter  - Error decrypting encrypted key
  org.apache.xml.security.encryption.XMLEncryptionException: No installed provider supports this key: sun.security.provider.DSAPrivateKey
  Original Exception was java.security.InvalidKeyException: No installed provider supports this key: sun.security.provider.DSAPrivateKey
  at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1479)
  at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:697)
  at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:628)
  at org.opensaml.xml.encryption.Decrypter.decryptUsingResolvedEncryptedKey(Decrypter.java:783)
  
  Caused by: java.security.InvalidKeyException: No installed provider supports this key: sun.security.provider.DSAPrivateKey
  at javax.crypto.Cipher.a(DashoA13*..)
  at javax.crypto.Cipher.init(DashoA13*..)
  at javax.crypto.Cipher.init(DashoA13*..)
  at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1475)
  ... 46 more
  740323 [http-8080-2] ERROR org.opensaml.xml.encryption.Decrypter  - Failed to decrypt EncryptedKey, valid decryption key could not be resolved
  740324 [http-8080-2] ERROR org.opensaml.xml.encryption.Decrypter  - Failed to decrypt EncryptedData using either EncryptedData KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver
  740325 [http-8080-2] ERROR org.opensaml.saml2.encryption.Decrypter  - SAML Decrypter encountered an error decrypting element content
  </code></pre>
  
  <p>Can anyone let me know where I am going wrong??</p>
  
  <p>Alternate command used Private Key generation instead of the above mentioned</p>
  
  <pre><code>keytool -genkey -alias privatekeyalias -keyalg RSA -keystore samlKeystore.jks
  </code></pre>
  
  <p>If I use this command and update JKS file, then I get a different exception mentioned as <strong>InvalidKeyException: Key is too long for unwrapping</strong>.</p>
  
  <pre><code>Caused by: java.security.InvalidKeyException: Key is too long for unwrapping
  at com.sun.crypto.provider.RSACipher.engineUnwrap(DashoA13*..)
  at javax.crypto.Cipher.unwrap(DashoA13*..)
  at org.apache.xml.security.encryption.XMLCipher.decryptKey(XMLCipher.java:1477)
  ... 46 more
  41   [http-8080-1] ERROR org.opensaml.xml.encryption.Decrypter  - Failed to decrypt EncryptedKey, valid decryption key could not be resolved
  42   [http-8080-1] ERROR org.opensaml.xml.encryption.Decrypter  - Failed to decrypt EncryptedData using either EncryptedData KeyInfoCredentialResolver or EncryptedKeyResolver + EncryptedKey KeyInfoCredentialResolver
  42   [http-8080-1] ERROR org.opensaml.saml2.encryption.Decrypter  - SAML Decrypter encountered an error decrypting element content
  </code></pre>
  
  <p>Can anyone help me out in this problem??</p>