apereo/cas · error · IllegalArgumentException

Unable to use 'none' as ID token signing algorithm

Error message

Unable to use 'none' as ID token signing algorithm

What it means

OidcIdTokenSigningAndEncryptionService.shouldSignToken throws this when a registered service sets its ID token signing algorithm to 'none' but the server's discovery settings do not allow 'none' among supported ID token signing algorithms. CAS refuses the combination as a likely misconfiguration. Notably, if 'none' IS supported, it logs an error and returns false (no signing) instead of throwing.

Solutions

Add 'none' to cas.authn.oidc.core.id-token-signing-alg-values-supported if unsigned ID tokens are acceptable for this flow
Or set the service's id-token signing algorithm to a supported value (e.g. RS256)
Check the advertised id_token_signing_alg_values_supported in discovery metadata

Example fix

// before (service definition)
"idTokenSigningAlg": "none"
// after
cas.authn.oidc.core.id-token-signing-alg-values-supported=RS256,ES256,none
// or
"idTokenSigningAlg": "RS256"

Defensive patterns

Strategy: validation

Validate before calling

var supported = discoveryMetadata.getIdTokenSigningAlgValuesSupported();
if ("none".equalsIgnoreCase(service.getIdTokenSigningAlg()) && !supported.contains("none")) {
    throw new IllegalStateException("Service " + service.getServiceId() + " requests 'none' ID token signing but server supports " + supported);
}

Try / catch

try { idTokenService.shouldSignToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error("ID token signing alg misconfigured for {}: {}", service.getClientId(), e.getMessage()); }

Prevention

Align service id-token signing alg with id_token_signing_alg_values_supported in discovery metadata
Validate service definitions against server config on deploy
Only allow 'none' for code-flow clients if your security policy permits unsigned ID tokens

When it happens

Trigger: registeredService.getIdTokenSigningAlg() equals 'none' and discoverySettings.getIdTokenSigningAlgValuesSupported() lacks 'none'; evaluated when issuing an ID token for that service.

Common situations: Admin chose 'none' (id_token via code flow allows it per spec) but the CAS discovery config only lists RS256/ES256 etc.; service definitions imported from an environment where 'none' was enabled.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/b6c366aec505cfb2. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java:63

            return super.getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey);
        }
        return svc.getIdTokenSigningAlg();
    }

    @Override
    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {
            if (!service.isSignIdToken()) {
                LOGGER.trace("Service [{}] does not require ID token to be signed", registeredService.getServiceId());
                return false;
            }
            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenSigningAlg())) {
                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                    LOGGER.error("Service [{}] has defined 'none' for ID token signing algorithm, "
                            + "yet CAS is configured to support the following signing algorithms: [{}]. "
                            + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                        registeredService.getServiceId(), discoverySettings.getIdTokenSigningAlgValuesSupported());
                    throw new IllegalArgumentException("Unable to use 'none' as ID token signing algorithm");
                }
                LOGGER.error("Service [{}] has defined 'none' for ID token signing algorithm", registeredService.getServiceId());
                return false;
            }
            return true;
        }
        return false;
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {
            if (service.isEncryptIdToken() && AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {
                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                    LOGGER.error("Service [{}] has defined 'none' for ID token encryption algorithm, "
                            + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                            + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                        registeredService.getServiceId(), discoverySettings.getIdTokenEncryptionAlgValuesSupported());

View on GitHub (pinned to e7288fc434)