apereo/cas · error · IllegalArgumentException

Unable to use 'none' as introspection signing algorithm

Error message

Unable to use 'none' as introspection signing algorithm

What it means

OidcTokenIntrospectionSigningAndEncryptionService.shouldSignToken throws when a registered service declares introspectionSignedResponseAlg='none' but CAS discovery metadata does not advertise 'none' as a supported introspection signing algorithm. The configuration is contradictory — the service asks for unsigned introspection responses the server does not allow — so CAS rejects it as a misconfiguration rather than producing an unsigned token.

Solutions

Add 'none' to cas.authn.oidc.discovery.introspectionSignedResponseAlgValuesSupported if unsigned introspection is truly desired.
Otherwise change the service definition's introspectionSignedResponseAlg to a supported algorithm such as RS256.
Leave introspectionSignedResponseAlg blank to use CAS defaults instead of 'none'.
Align service registration JSON with the discovery configuration before re-running introspection.

Example fix

// before (service JSON)
"introspectionSignedResponseAlg": "none"
// after
"introspectionSignedResponseAlg": "RS256"

Defensive patterns

Strategy: validation

Validate before calling

String alg = service.getIntrospectionSignedResponseAlg();
List<String> supported = discoverySettings.getIntrospectionSignedResponseAlgValuesSupported();
if ("none".equalsIgnoreCase(alg) && !supported.contains("none")) {
    throw new IllegalStateException("'none' not supported for introspection signing");
}

Try / catch

try { introspectionService.shouldSignToken(service, discovery); } catch (IllegalArgumentException e) {
    LOGGER.error("Fix service {} signing alg", service.getServiceId(), e);
}

Prevention

Keep service definitions and discovery algorithm lists in sync via review checklist
Prefer leaving alg unset over specifying 'none'
Validate service JSON against discovery settings at registration time

When it happens

Trigger: Registering an OIDC service with introspectionSignedResponseAlg='none' while cas.authn.oidc.discovery.introspectionSignedResponseAlgValuesSupported omits 'none', then triggering token introspection.

Common situations: Copying a service definition from another CAS deployment with different discovery settings; forgetting that 'none' must be explicitly enabled in discovery supported values; tightening security settings after services already specified 'none'.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/5436cac12e98ec43. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java:61

    public String getJsonWebKeySigningAlgorithm(final OAuthRegisteredService registeredService,
                                                final JsonWebKey jsonWebKey) {
        return StringUtils.defaultIfBlank(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.RSA_USING_SHA512);
    }

    @Override
    protected String getSigningMediaType() {
        return MediaType.parseMediaType(OAuth20Constants.INTROSPECTION_JWT_HEADER_CONTENT_TYPE).getSubtype();
    }

    @Override
    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {
        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionSignedResponseAlg())
            && !discoverySettings.getIntrospectionSignedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
            LOGGER.error("Service [{}] has defined 'none' for introspection signing algorithm, "
                    + "yet CAS is configured to support the following signing algorithms: [{}]. "
                    + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                registeredService.getServiceId(), discoverySettings.getIntrospectionSignedResponseAlgValuesSupported());
            throw new IllegalArgumentException("Unable to use 'none' as introspection signing algorithm");
        }
        return StringUtils.isNotBlank(registeredService.getIntrospectionSignedResponseAlg())
            && !Strings.CI.equals(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.NONE);
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionEncryptedResponseAlg())
            && !discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
            LOGGER.error("Service [{}] has defined 'none' for introspection encryption algorithm, "
                    + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                    + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                registeredService.getServiceId(), discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported());
            throw new IllegalArgumentException("Unable to use 'none' as introspection encryption algorithm");
        }
        return StringUtils.isNotBlank(registeredService.getIntrospectionEncryptedResponseAlg())
            && !Strings.CI.equals(registeredService.getIntrospectionEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);
    }

View on GitHub (pinned to e7288fc434)