Never mind. I think I found my answer further down in the file. <!-- Logs unencrypted SAML at DEBUG level --> <logger name="org.opensaml.saml.saml2.encryption.Encrypter" level="${idp.loglevel.encryption:-INFO}" />