apereo/cas · error · IllegalArgumentException

Public key from endpoint for key id is undefined

Error message

Public key from endpoint for key id  is undefined

What it means

While preparing encoding (encryption) parameters, the RSA JWK chosen from the remote JWKS endpoint has no public key, so it cannot be used to encrypt payloads; IllegalArgumentException aborts encode configuration. The input at fault is the endpoint JWK with the given key id.

Solutions

1. Verify the JWKS endpoint publishes complete RSA public keys ('n','e')
2. Refetch/refresh the JWKS — the cached set may be stale or corrupt
3. Check key-id filtering so a valid RSA key is selected

When it happens

Trigger: Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:148 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/96230500dca03bd8. Report an issue: GitHub.

Appendix: source

Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:148

                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
            }
        });
    }

    private void configureEncryptionParametersForEncoding() {
        FunctionUtils.doUnchecked(param -> {
            if (httpsJkws.isEmpty()) {
                LOGGER.debug("No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped");
            } else {
                val keys = this.httpsJkws.get().getJsonWebKeys();
                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);

                if (encKeyResult.isEmpty()) {
                    throw new IllegalArgumentException("Could not locate RSA JSON web key from endpoint");
                }
                val encKey = encKeyResult.get();
                if (encKey.getPublicKey() == null) {
                    throw new IllegalArgumentException("Public key from endpoint for key id " + encKey.getKeyId() + " is undefined");
                }
                setEncryptionKey(encKey.getPublicKey());
                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);
            }
        });
    }

    private void configureSigningParametersForEncoding() {
        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());
        if (result.isEmpty()) {
            throw new IllegalArgumentException("Could not locate RSA JSON web key from keystore");
        }
        val key = result.get();
        if (key.getPrivateKey() == null) {
            throw new IllegalArgumentException("Private key located from keystore for key id " + key.getKeyId() + " is undefined");
        }
        setSigningKey(key.getPrivateKey());

View on GitHub (pinned to e7288fc434)