apereo/cas · error · IllegalArgumentException

Unable to use 'none' as introspection encryption algorithm

Error message

Unable to use 'none' as introspection encryption algorithm

What it means

The encryption counterpart of shouldSignToken: shouldEncryptToken throws when a registered service sets introspectionEncryptedResponseAlg='none' but discovery metadata does not list 'none' among supported introspection encryption algorithms. CAS treats this mismatch as server/service misconfiguration and refuses to proceed with introspection response encryption.

Solutions

Add 'none' to cas.authn.oidc.discovery.introspectionEncryptedResponseAlgValuesSupported if unencrypted introspection responses are acceptable.
Otherwise set the service's introspectionEncryptedResponseAlg to a supported algorithm (e.g. RSA-OAEP-256 / A256GCM family).
Remove the introspectionEncryptedResponseAlg setting from the service to fall back to defaults.
Reconcile the service registry with current discovery settings after upgrades.

Example fix

// before (service JSON)
"introspectionEncryptedResponseAlg": "none"
// after
"introspectionEncryptedResponseAlg": "RSA-OAEP-256"

Defensive patterns

Strategy: validation

Validate before calling

String alg = service.getIntrospectionEncryptedResponseAlg();
List<String> supported = discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported();
if ("none".equalsIgnoreCase(alg) && !supported.contains("none")) {
    throw new IllegalStateException("'none' not supported for introspection encryption");
}

Try / catch

try { introspectionService.shouldEncryptToken(service, discovery); } catch (IllegalArgumentException e) {
    LOGGER.error("Fix service {} encryption alg", service.getServiceId(), e);
}

Prevention

Mirror signing/encryption settings changes across environments
Use a registration validator that checks alg values against discovery metadata
After security hardening, audit services still specifying 'none'

When it happens

Trigger: Triggering token introspection for a service whose introspectionEncryptedResponseAlg is 'none' while cas.authn.oidc.discovery.introspectionEncryptedResponseAlgValuesSupported excludes 'none'.

Common situations: Service definitions copied across environments with different discovery encryption settings; expecting 'none' to simply disable encryption without enabling it in discovery; security hardening that removed 'none' from supported values.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/a25a272e7d3073bb. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java:75

            LOGGER.error("Service [{}] has defined 'none' for introspection signing algorithm, "
                    + "yet CAS is configured to support the following signing algorithms: [{}]. "
                    + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                registeredService.getServiceId(), discoverySettings.getIntrospectionSignedResponseAlgValuesSupported());
            throw new IllegalArgumentException("Unable to use 'none' as introspection signing algorithm");
        }
        return StringUtils.isNotBlank(registeredService.getIntrospectionSignedResponseAlg())
            && !Strings.CI.equals(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.NONE);
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionEncryptedResponseAlg())
            && !discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
            LOGGER.error("Service [{}] has defined 'none' for introspection encryption algorithm, "
                    + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                    + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                registeredService.getServiceId(), discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported());
            throw new IllegalArgumentException("Unable to use 'none' as introspection encryption algorithm");
        }
        return StringUtils.isNotBlank(registeredService.getIntrospectionEncryptedResponseAlg())
            && !Strings.CI.equals(registeredService.getIntrospectionEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);
    }

    @Override
    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {
        return this.discoverySettings.getIntrospectionSignedResponseAlgValuesSupported();
    }

    @Override
    protected String encryptToken(final OAuthRegisteredService registeredService,
                                  final String innerJwt) {
        val jsonWebKey = getJsonWebKeyForEncryption(registeredService);
        return JsonWebTokenEncryptor.builder()
            .key(jsonWebKey.getPublicKey())
            .keyId(jsonWebKey.getKeyId())
            .algorithm(registeredService.getIntrospectionEncryptedResponseAlg())

View on GitHub (pinned to e7288fc434)