Encryption/Signing is not enabled explicitly in the…

Error message

Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.

What it means

DelegatedAuthenticationEventExecutionPlanConfiguration, when building the delegatedClientDistributedSessionCookieCipherExecutor bean, warns if the distributed-session cookie's crypto.enabled flag is false but both encryption and signing keys are configured. CAS assumes the keys imply intent and force-enables crypto rather than silently ignoring them.

Solutions

Set cas.authn.pac4j.cookie.crypto.enabled=true to make the intent explicit and remove the warning.
If encryption/signing is truly not wanted, remove the encryption.key and signing.key values so the keys and the flag agree.
Restart and confirm only one of the two states (enabled with keys, or disabled with no keys) is configured.

Example fix

// before
cas.authn.pac4j.cookie.crypto.enabled=false
cas.authn.pac4j.cookie.crypto.signing.key=...
cas.authn.pac4j.cookie.crypto.encryption.key=...
// after
cas.authn.pac4j.cookie.crypto.enabled=true
cas.authn.pac4j.cookie.crypto.signing.key=...
cas.authn.pac4j.cookie.crypto.encryption.key=...

Defensive patterns

Strategy: validation

Validate before calling

var crypto = casProperties.getAuthn().getPac4j().getCookie().getCrypto();
if (!crypto.isEnabled() && (StringUtils.isNotBlank(crypto.getEncryption().getKey()) || StringUtils.isNotBlank(crypto.getSigning().getKey()))) {
    throw new IllegalStateException("cookie crypto keys set but crypto.enabled=false");
}

Prevention

Treat crypto.enabled and key presence as one unit when editing config.
If keys are provisioned by tooling, have the tooling set enabled=true too.

When it happens

Trigger: cas.authn.pac4j.cookie.crypto.enabled=false (or unset) while cas.authn.pac4j.cookie.crypto.encryption.key and .signing.key are both set, at configuration time of the delegated authentication plan.

Common situations: Operators pasted key-generation output (cas authn pac4j cookie generate-key) but forgot to flip enabled=true; config copied from a template where enabled was explicitly false; keys inherited from environment variables with enabled left at default false.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/c6bc6d1924f897ed. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-pac4j-webflow/src/main/java/org/apereo/cas/config/DelegatedAuthenticationEventExecutionPlanConfiguration.java:142

    }

    @Configuration(value = "DelegatedAuthenticationEventExecutionPlanCoreConfiguration", proxyBeanMethods = false)
    @EnableConfigurationProperties(CasConfigurationProperties.class)
    static class DelegatedAuthenticationEventExecutionPlanCoreConfiguration {

        @ConditionalOnMissingBean(name = "delegatedClientDistributedSessionCookieCipherExecutor")
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        @Bean
        public CipherExecutor delegatedClientDistributedSessionCookieCipherExecutor(final CasConfigurationProperties casProperties) {
            val replication = casProperties.getAuthn().getPac4j().getCore().getSessionReplication();
            return FunctionUtils.doIf(replication.isReplicateSessions(),
                () -> {
                    val cookie = replication.getCookie();
                    val crypto = cookie.getCrypto();
                    var enabled = crypto.isEnabled();
                    if (!enabled && StringUtils.isNotBlank(crypto.getEncryption().getKey())
                        && StringUtils.isNotBlank(crypto.getSigning().getKey())) {
                        LOGGER.warn("Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys "
                            + "are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.", cookie.getName());
                        enabled = true;
                    }
                    return enabled
                        ? CipherExecutorUtils.newStringCipherExecutor(crypto, DelegatedClientAuthenticationDistributedSessionCookieCipherExecutor.class)
                        : CipherExecutor.noOp();
                },
                CipherExecutor::noOp).get();
        }

        @ConditionalOnMissingBean(name = "delegatedClientDistributedSessionCookieGenerator")
        @Bean
        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)
        @Deprecated(since = "7.3.0", forRemoval = true)
        public CasCookieBuilder delegatedClientDistributedSessionCookieGenerator(
            @Qualifier(TenantExtractor.BEAN_NAME)
            final TenantExtractor tenantExtractor,
            @Qualifier(GeoLocationService.BEAN_NAME)

View on GitHub (pinned to e7288fc434)