apereo/cas · error · IllegalArgumentException

Private key located from keystore for key id is undefined

Error message

Private key located from keystore for key id  is undefined

What it means

While preparing encoding (signing) parameters, the RSA JWK found in the local keystore for the configured key id has no private key, so payloads cannot be signed; IllegalArgumentException aborts encode configuration. The input at fault is the keystore JWK entry — a public-only key was supplied where a signing (private) key is required.

Solutions

1. Configure the full JWK key pair including the private key ('d') in the keystore
2. Regenerate the signing key pair and reload the keystore
3. Point the executor at the keystore variant that contains private key material

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:164 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/63a65f716d6964d5. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:164

                val encKey = encKeyResult.get();
                if (encKey.getPublicKey() == null) {
                    throw new IllegalArgumentException("Public key from endpoint for key id " + encKey.getKeyId() + " is undefined");
                }
                setEncryptionKey(encKey.getPublicKey());
                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
            }
        });
    }

    private void configureSigningParametersForEncoding() {
        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());
        if (result.isEmpty()) {
            throw new IllegalArgumentException("Could not locate RSA JSON web key from keystore");
        }
        val key = result.get();
        if (key.getPrivateKey() == null) {
            throw new IllegalArgumentException("Private key located from keystore for key id " + key.getKeyId() + " is undefined");
        }
        setSigningKey(key.getPrivateKey());
    }

    private Optional<RsaJsonWebKey> findRsaJsonWebKeyByProvidedKeyId(final List<JsonWebKey> keys) {
        val predicate = this.keyIdToUse
            .<Predicate<JsonWebKey>>map(s -> jsonWebKey -> jsonWebKey.getKeyId()
                .equalsIgnoreCase(s))
            .orElseGet(() -> jsonWebKey -> true);
        return findRsaJsonWebKey(keys, predicate);
    }
}

View on GitHub (pinned to e7288fc434)