apereo/cas · error · IllegalArgumentException

Unable to use 'none' as user-info encryption algorithm

Error message

Unable to use 'none' as user-info encryption algorithm

What it means

OidcUserProfileSigningAndEncryptionService.shouldEncryptToken throws this when a registered service sets its userinfo encrypted-response alg to 'none' while the server's discovery settings do not list 'none' as a supported userinfo encryption alg. Since 'none' is not a meaningful encryption algorithm, this always indicates misconfiguration of the server or the service definition.

Solutions

Set the service's userinfo encryption alg to a real algorithm (e.g. RSA-OAEP-256, RSA1_5, dir) that the server supports
If no encryption is wanted, clear the userinfo encrypted-response alg (leave blank) instead of using 'none'
Verify cas.authn.oidc.core user-info encryption alg values supported in CAS properties

Example fix

// before (service definition)
"userInfoEncryptedResponseAlg": "none"
// after
"userInfoEncryptedResponseAlg": "RSA-OAEP-256"
// or leave blank to disable encryption

Defensive patterns

Strategy: validation

Validate before calling

if ("none".equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())) {
    throw new IllegalStateException("'none' is not a valid userinfo encryption alg for service " + service.getServiceId());
}

Try / catch

try { profileService.shouldEncryptToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error("Service userinfo encryption alg misconfigured: {}", e.getMessage()); }

Prevention

Never put 'none' in any encryption alg field — it is only a signing value
Leave encryption alg blank to disable userinfo encryption
Lint service registry JSON for reserved algorithm values before publishing

When it happens

Trigger: registeredService.getUserInfoEncryptedResponseAlg() equals 'none' (case-insensitive) and discoverySettings.getUserInfoEncryptionAlgValuesSupported() does not contain 'none'; evaluated while preparing an encrypted userinfo response.

Common situations: Admin typo'd or misread the encryption alg field and put 'none' (a signing-only value) into the encryption field; service definition template reused without adjusting encryption settings.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/4410fe7707fca783. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java:83

                throw new IllegalArgumentException("Unable to use 'none' for the user-info signing algorithm");
            }
            return StringUtils.isNotBlank(service.getUserInfoSigningAlg())
                   && !Strings.CI.equals(service.getUserInfoSigningAlg(), AlgorithmIdentifiers.NONE);
        }
        return false;
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {

            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())
                && !discoverySettings.getUserInfoEncryptionAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                LOGGER.error("Service [{}] has defined 'none' for user-info encryption algorithm, "
                             + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                             + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                    registeredService.getServiceId(), discoverySettings.getUserInfoEncryptionAlgValuesSupported());
                throw new IllegalArgumentException("Unable to use 'none' as user-info encryption algorithm");
            }
            return StringUtils.isNotBlank(service.getUserInfoEncryptedResponseAlg())
                   && !Strings.CI.equals(service.getUserInfoEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);
        }
        return false;
    }

    @Override
    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {
        return this.discoverySettings.getUserInfoSigningAlgValuesSupported();
    }

    @Override
    protected String encryptToken(final OAuthRegisteredService service,
                                  final String innerJwt) {
        if (service instanceof final OidcRegisteredService svc) {
            val jsonWebKey = getJsonWebKeyForEncryption(svc);
            return JsonWebTokenEncryptor.builder()

View on GitHub (pinned to e7288fc434)