Encrypted method [ ] is not supported for algorithm [ ]…

Error message

Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]

What it means

GenerateJwtCommand.configureJwtEncryption validates the requested JWE algorithm/encryption-method pair against Nimbus JOSE JWT provider constants. If the algorithm is one supported by DirectCryptoProvider but the encryption method is not among DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS, it logs this warning and returns without setting encryption configuration, so the JWT is generated unencrypted (or generation proceeds without the requested encryption).

Solutions

Use a method from DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS (printed in the warning) with the direct algorithm.
If you need AES-CBC/GCM methods, switch the algorithm to one in AESCryptoProvider.SUPPORTED_ALGORITHMS (see the next check).
Verify the --encryption-method value matches a Nimbus EncryptionMethod name exactly.

Example fix

// before
--encryption-algorithm dir --encryption-method A256GCM
// after
--encryption-algorithm dir --encryption-method A128CBC-HS256

Defensive patterns

Strategy: validation

Validate before calling

JWEAlgorithm alg = JWEAlgorithm.parse(encryptionAlgorithm);
EncryptionMethod method = EncryptionMethod.parse(encryptionMethod);
if (DirectCryptoProvider.SUPPORTED_ALGORITHMS.contains(alg)
    && !DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(method)) {
    throw new IllegalArgumentException("dir algorithm requires method in " + DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);
}

Prevention

Pair 'dir' only with methods listed in DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.
Check the warning output — it prints the accepted methods.
Use Nimbus' JWE algorithm/method compatibility table when composing options.

When it happens

Trigger: Running the generate-jwt shell command with --encryption-algorithm set to a direct (dir) style algorithm while passing an encryption method incompatible with it, e.g. 'dir' with A256GCM or a RSA-only method.

Common situations: Copy-pasting method names between RSA/AES/direct configurations; typos like 'A256CBC-HS512' with wrong casing; assuming any standard EncryptionMethod works with any algorithm.

Understand the failure class

Background: "invalid argument", "unknown mode", "not supported": invalid enum-like argument errors explained — this error's family across 19 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/6c8ce04656b4a777. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jwt/GenerateJwtCommand.java:152

            }))
            .collect(Collectors.joining(","));
        LOGGER.debug("Encryption algorithm: [{}]. Available algorithms are [{}]", encryptionAlgorithm, acceptedEncAlgs);

        val acceptedEncMethods = Arrays.stream(EncryptionMethod.class.getDeclaredFields())
            .filter(f -> f.getType().equals(EncryptionMethod.class))
            .map(Unchecked.function(f -> {
                f.setAccessible(true);
                return ((Algorithm) f.get(null)).getName();
            }))
            .collect(Collectors.joining(","));
        LOGGER.debug("Encryption method: [{}]. Available methods are [{}]", encryptionMethod, acceptedEncMethods);

        val algorithm = JWEAlgorithm.parse(encryptionAlgorithm);
        val encryptionMethodAlg = EncryptionMethod.parse(encryptionMethod);

        if (DirectCryptoProvider.SUPPORTED_ALGORITHMS.contains(algorithm)
            && !DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(encryptionMethodAlg)) {
            LOGGER.warn("Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]",
                encryptionMethod, encryptionAlgorithm, DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);
            return;
        }
        if (AESCryptoProvider.SUPPORTED_ALGORITHMS.contains(algorithm)
            && !AESCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(encryptionMethodAlg)) {
            LOGGER.warn("Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]",
                encryptionMethod, encryptionAlgorithm, AESCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);
            return;
        }
        g.setEncryptionConfiguration(new SecretEncryptionConfiguration(encryptionSecret, algorithm, encryptionMethodAlg));
    }

    private static void configureJwtSigning(final int signingSecretSize, final String signingAlgorithm, final JwtGenerator g) {
        if (signingSecretSize <= 0 || StringUtils.isBlank(signingAlgorithm)) {
            LOGGER.info("No signing algorithm or size specified, so the generated JWT will not be encrypted");
            return;
        }

View on GitHub (pinned to e7288fc434)