apereo/cas · error · IllegalArgumentException

Unable to use 'none' as ID token encryption algorithm

Error message

Unable to use 'none' as ID token encryption algorithm

What it means

OidcIdTokenSigningAndEncryptionService.shouldEncryptToken throws this when a service with ID token encryption enabled sets its ID token encryption alg to 'none' and the server's discovery settings do not support 'none'. The source also has a likely copy-paste bug: it checks idTokenSigningAlgValuesSupported (signing list) instead of the encryption list, so the guard compares against the wrong set.

Solutions

  1. Set the service's ID token encryption alg to a real JWE algorithm (e.g. RSA-OAEP-256, dir) supported by the server
  2. If no encryption is intended, disable encrypt-id-token on the service instead of using 'none' for the alg
  3. As a server-side workaround, include 'none' in the supported signing alg values (the code checks the signing list due to the copy-paste) — better fixed in code by comparing against the encryption list

Example fix

// before (service definition)
"encryptIdToken": true,
"idTokenEncryptionAlg": "none"
// after
"encryptIdToken": true,
"idTokenEncryptionAlg": "RSA-OAEP-256"
// or disable encryption entirely
"encryptIdToken": false
Defensive patterns

Strategy: validation

Validate before calling

if (service.isEncryptIdToken() && "none".equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {
    throw new IllegalStateException("'none' is not a valid ID token encryption alg; set a JWE alg or disable encryption");
}

Try / catch

try { idTokenService.shouldEncryptToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error("ID token encryption alg misconfigured: {}", e.getMessage()); }

Prevention

When it happens

Trigger: service.isEncryptIdToken() is true and service.getIdTokenEncryptionAlg() equals 'none'; discoverySettings.getIdTokenSigningAlgValuesSupported() does not contain 'none'; evaluated while preparing an encrypted ID token.

Common situations: Admin mistakenly put 'none' in the encryption alg field (it is only meaningful for signing); service definition templated from a signing-only config; upgrading CAS where the guard logic checks the wrong discovery list.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/5046347d86348ac8. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java:82

                }
                LOGGER.error("Service [{}] has defined 'none' for ID token signing algorithm", registeredService.getServiceId());
                return false;
            }
            return true;
        }
        return false;
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {
            if (service.isEncryptIdToken() && AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {
                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                    LOGGER.error("Service [{}] has defined 'none' for ID token encryption algorithm, "
                            + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                            + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                        registeredService.getServiceId(), discoverySettings.getIdTokenEncryptionAlgValuesSupported());
                    throw new IllegalArgumentException("Unable to use 'none' as ID token encryption algorithm");
                }
                LOGGER.error("Service [{}] has defined 'none' for ID token encryption algorithm", registeredService.getServiceId());
                return false;
            }

            return service.isEncryptIdToken()
                && StringUtils.isNotBlank(service.getIdTokenEncryptionAlg())
                && StringUtils.isNotBlank(service.getIdTokenEncryptionEncoding());
        }
        return false;
    }

    @Override
    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {
        return this.discoverySettings.getIdTokenSigningAlgValuesSupported();
    }

    @Override

View on GitHub (pinned to e7288fc434)