apereo/cas · error · IllegalArgumentException

Private key located from endpoint for key id is undefined

Error message

Private key located from endpoint for key id  is undefined

What it means

The RSA JWK selected from the remote JWKS endpoint for decryption has no private key component, so ciphertext cannot be decrypted; IllegalArgumentException aborts decode configuration. The input at fault is the endpoint-published JWK with the given key id — endpoints typically publish public keys only, which suffices for encoding but not decoding.

Solutions

1. Ensure the private key is held by the party that must decrypt; fetch the JWKS from a source that publishes the private JWK
2. Split encode/decode key configuration so decoding uses the local keystore containing the private key
3. Regenerate a key pair and distribute keys appropriately (public to endpoint, private to decryptor)

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:126 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/b2b44e6ad0364154. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:126

            throw new IllegalArgumentException("Public key located from keystore for key id " + key.getKeyId() + " is undefined");
        }
        setSigningKey(key.getPublicKey());
    }

    private void configureEncryptionParametersForDecoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();
                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);

                if (encKeyResult.isEmpty()) {
                    throw new IllegalArgumentException("Could not locate RSA JSON web key from endpoint");
                }
                val encKey = encKeyResult.get();
                if (encKey.getPrivateKey() == null) {
                    throw new IllegalArgumentException("Private key located from endpoint for key id " + encKey.getKeyId() + " is undefined");
                }
                setEncryptionKey(encKey.getPrivateKey());
                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
            }
        });
    }

    private void configureEncryptionParametersForEncoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();
                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);

                if (encKeyResult.isEmpty()) {
                    throw new IllegalArgumentException("Could not locate RSA JSON web key from endpoint");

View on GitHub (pinned to e7288fc434)