apereo/cas · error · IllegalArgumentException

Could not locate RSA JSON web key from endpoint

Error message

Could not locate RSA JSON web key from endpoint

What it means

While preparing decoding (decryption) parameters, a JWKS endpoint is configured, but no RSA JWK could be selected from the keys fetched from that remote endpoint; IllegalArgumentException aborts decode. The input at fault is the remote JWKS content (or its key-id filter), which lacks a usable RSA key for decryption.

Solutions

1. Confirm the JWKS endpoint is reachable and returns a valid JWKS document containing RSA keys
2. Check the configured key id against the kids published by the endpoint
3. Refresh/redeploy the remote party's keys and verify CAS fetches the latest JWKS

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:122 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/f723b2ad29b2bee7. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:122

            throw new IllegalArgumentException("Could not locate RSA JSON web key from keystore");
        }
        val key = result.get();
        if (key.getPublicKey() == null) {
            throw new IllegalArgumentException("Public key located from keystore for key id " + key.getKeyId() + " is undefined");
        }
        setSigningKey(key.getPublicKey());
    }

    private void configureEncryptionParametersForDecoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();
                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);

                if (encKeyResult.isEmpty()) {
                    throw new IllegalArgumentException("Could not locate RSA JSON web key from endpoint");
                }
                val encKey = encKeyResult.get();
                if (encKey.getPrivateKey() == null) {
                    throw new IllegalArgumentException("Private key located from endpoint for key id " + encKey.getKeyId() + " is undefined");
                }
                setEncryptionKey(encKey.getPrivateKey());
                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
            }
        });
    }

    private void configureEncryptionParametersForEncoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();

View on GitHub (pinned to e7288fc434)