alibaba/nacos · error · RuntimeException

Failed to sign payload

Error message

Failed to sign payload

What it means

A RuntimeException wrapping any exception thrown during HMAC-SHA256 signing of the OIDC state parameter. The underlying cause is attached. Most often it wraps an IllegalStateException from getSigningKey() (blank client secret), but it can also wrap JCE/InvalidKeyException failures.

Source

Thrown at plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/authenticate/AuthorizationCodeHandler.java:338

        }
    }
    
    /**
     * Sign a payload using HMAC-SHA256.
     *
     * @param payload the payload to sign
     * @return base64-encoded signature
     */
    private String hmacSign(String payload) {
        try {
            Mac mac = Mac.getInstance(HMAC_ALGORITHM);
            SecretKeySpec keySpec = new SecretKeySpec(
                getSigningKey().getBytes(StandardCharsets.UTF_8), HMAC_ALGORITHM);
            mac.init(keySpec);
            byte[] signature = mac.doFinal(payload.getBytes(StandardCharsets.UTF_8));
            return Base64.getUrlEncoder().withoutPadding().encodeToString(signature);
        } catch (Exception e) {
            throw new RuntimeException("Failed to sign payload", e);
        }
    }
    
    /**
     * Verify HMAC signature.
     *
     * @param payload   the original payload
     * @param signature the signature to verify
     * @return true if signature is valid
     */
    private boolean hmacVerify(String payload, String signature) {
        String expectedSignature = hmacSign(payload);
        return expectedSignature.equals(signature);
    }
    
    /**
     * Get the signing key for HMAC operations.
     * Uses client secret as the signing key.

View on GitHub (pinned to 9b989acdf1)

Solutions

1. Inspect the wrapped cause exception — if it is 'Client secret is required for state signing', set nacos.plugin.auth.oidc.client-secret.
2. If the cause is NoSuchAlgorithmException/InvalidKeyException, check the JCE provider and JVM security policy (FIPS mode).
3. Ensure the client-secret config key is spelled exactly 'client-secret' and the value is non-blank.
4. Confirm HmacSHA256 is available: the default JDK provider supplies it, so this only fails in hardened/custom JVMs.

Example fix

// before: authorization-code flow used with no client secret
nacos.plugin.auth.oidc.client-id=myclient
# client-secret missing
// after
nacos.plugin.auth.oidc.client-id=myclient
nacos.plugin.auth.oidc.client-secret=s3cret-value

// Before starting the authorization-code flow, ensure a signing key is available
if (StringUtils.isBlank(config.getClientSecret())) {
    throw new IllegalStateException(
        "client-secret must be set for authorization-code state signing");
}

try {
    String authUrl = handler.buildAuthorizationUrl(redirectUri);
} catch (RuntimeException e) {
    if (e.getMessage().equals("Failed to sign payload")) {
        Throwable cause = e.getCause();
        // cause is typically IllegalStateException for blank client-secret
        log.error("State signing failed: {}", cause.getMessage());
    }
    throw e;
}

When it happens

Trigger: buildAuthorizationUrl or verifyAndDecodeState calls hmacSign, which calls getSigningKey() while client-secret is blank (the IllegalStateException is caught and rewrapped here), or the HmacSHA256 algorithm/provider is unavailable in the JVM.

Common situations: Authorization-code flow enabled without configuring client-secret; running in a FIPS/restricted JVM where HmacSHA256 is not available; a security manager blocking Mac.getInstance; client-secret config key typo.

Related errors

• Token endpoint not configured
• Client secret is required for state signing
• Token exchange failed:
• Authorization endpoint not configured
• Nonce not present in ID token. Set 'nacos.plugin.auth.oidc.s

AI-assisted analysis of alibaba/nacos@9b989acdf1 (2026-08-14). Data as JSON: /api/errors/f511a8e4b00f0e89. Report an issue: GitHub.