apereo/cas · error · IllegalArgumentException

Could not determine the hash algorithm for token

Error message

Could not determine the hash algorithm for token

What it means

Thrown as IllegalArgumentException by the token-hash generator when the JWS algorithm identifier of the access token does not map to any supported message-digest (hash) algorithm. Only SHA-256-family combinations (HMAC/RSA/RSA-PSS/ECDSA P-256 with SHA256) are currently recognized, so at-token hashing (e.g. for token binding in introspection or id_token claims) cannot proceed.

Solutions

1. Configure the access token signing algorithm to a supported SHA-256 variant (HS256, RS256, PS256, or ES256)
2. If you need stronger algorithms, extend the mapping in determineSigningHashAlgorithm to add SHA-384/SHA-512 cases and corresponding digests
3. Check cas.authn.oauth.accessToken.jwt* settings for an algorithm override that introduced the unsupported alg
4. Verify no upstream proxy re-signs tokens with a different algorithm before hashing

Example fix

// before
cas.authn.oauth.access-token.jwt-alg=RS512
// after
cas.authn.oauth.access-token.jwt-alg=RS256

const SUPPORTED = ['HS256','RS256','PS256','ES256'];
if (!SUPPORTED.includes(signingAlg)) throw new Error(`algorithm ${signingAlg} cannot be hashed by OAuth20TokenHashGenerator; use a SHA-256 family algorithm`);

When it happens

Trigger: Generating an at_hash/token hash for an access token signed with an algorithm other than the supported SHA-256 set — e.g. HS384/HS512, RS384/RS512, ES384/ES512/EdDSA tokens reaching the hash generator.

Common situations: Configuring the access-token JWT builder with a stronger algorithm (RS512, ES512) while some downstream component still calls the hash generator that only supports SHA-256; version upgrades where token signing algorithm was changed but hashing path was not updated.

Related errors

• Proof JWT algorithm is invalid
• Proof JWT algorithm does not match RSA holder key
• Proof JWT algorithm does not match EC holder key
• Unable to accept the ID token with an invalid [sub] claim
• Unknown authorization header type

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/9168981967e408b1. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oauth-core-api/src/main/java/org/apereo/cas/support/oauth/web/response/accesstoken/OAuth20TokenHashGenerator.java:73

        if (AlgorithmIdentifiers.HMAC_SHA512.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_USING_SHA512.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_PSS_USING_SHA512.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.ECDSA_USING_P521_CURVE_AND_SHA512.equalsIgnoreCase(algorithm)) {
            return MessageDigestAlgorithms.SHA_512;
        }
        if (AlgorithmIdentifiers.HMAC_SHA384.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_USING_SHA384.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_PSS_USING_SHA384.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.ECDSA_USING_P384_CURVE_AND_SHA384.equalsIgnoreCase(algorithm)) {
            return MessageDigestAlgorithms.SHA_384;
        }
        if (AlgorithmIdentifiers.HMAC_SHA256.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_USING_SHA256.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.RSA_PSS_USING_SHA256.equalsIgnoreCase(algorithm)
            || AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256.equalsIgnoreCase(algorithm)) {
            return MessageDigestAlgorithms.SHA_256;
        }
        throw new IllegalArgumentException("Could not determine the hash algorithm for token");
    }
}

View on GitHub (pinned to e7288fc434)