apereo/cas · error · IllegalArgumentException

Unable to use 'none' for the user-info signing algorithm

Error message

Unable to use 'none' for the user-info signing algorithm

What it means

OidcUserProfileSigningAndEncryptionService.shouldSignToken throws this when a registered OIDC service sets its userinfo signing algorithm to 'none' (unsigned), but the CAS server's discovery metadata does not advertise 'none' among supported userinfo signing alg values. It signals a mismatch between the service definition and server configuration, so CAS refuses rather than silently issuing an unsigned response.

Solutions

Add 'none' to cas.authn.oidc.core.user-info-signing-alg-values-supported in CAS properties if unsigned userinfo responses are truly desired
Or change the service definition's userinfo signing algorithm to a supported value like RS256
Review discovery metadata at /.well-known/openid-configuration to confirm which userinfo signing algs the server advertises

Example fix

// before (service definition)
"userInfoSigningAlg": "none"
// after (cas.properties, if 'none' is intended)
cas.authn.oidc.core.user-info-signing-alg-values-supported=RS256,ES256,none
// or change the service definition
"userInfoSigningAlg": "RS256"

Defensive patterns

Strategy: validation

Validate before calling

var supported = discoveryMetadata.getUserInfoSigningAlgValuesSupported();
if ("none".equalsIgnoreCase(service.getUserInfoSigningAlg()) && !supported.contains("none")) {
    throw new IllegalStateException("Service " + service.getServiceId() + " requests 'none' userinfo signing but server supports only " + supported);
}

Try / catch

try { profileService.shouldSignToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error("Fix service userinfo signing alg or CAS discovery config: {}", e.getMessage()); }

Prevention

Keep service userinfo signing alg within the algs advertised in /.well-known/openid-configuration
Validate service definitions against discovery metadata at import time
Document the pairing of cas.authn.oidc.core.*-supported lists with service registry values

When it happens

Trigger: A registered service has cas/service/oidc user-info signing alg set to 'none' while discoverySettings.getUserInfoSigningAlgValuesSupported() (from cas.authn.oidc.core.user-info-signing-alg-values-supported or defaults) does not include 'none'; shouldSignToken is invoked when building a userinfo response for that service.

Common situations: Admin sets userinfo signing alg to 'none' in the service registry but forgets to add 'none' to the server's supported signing algorithm list; server upgraded and defaults no longer include 'none'; copy-pasted service definition from another CAS instance with different discovery config.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/49a92d1430159110. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java:65

    @Override
    public String getJsonWebKeySigningAlgorithm(final OAuthRegisteredService registeredService,
                                                final JsonWebKey jsonWebKey) {
        if (registeredService instanceof final OidcRegisteredService oidcService) {
            return oidcService.getUserInfoSigningAlg();
        }
        return super.getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey);
    }

    @Override
    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {
            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoSigningAlg())
                && !discoverySettings.getUserInfoSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                LOGGER.error("Service [{}] has defined 'none' for user-info signing algorithm, "
                             + "yet CAS is configured to support the following signing algorithms: [{}]. "
                             + "This is quite likely due to misconfiguration of the CAS server or the service definition.",
                    registeredService.getServiceId(), discoverySettings.getUserInfoSigningAlgValuesSupported());
                throw new IllegalArgumentException("Unable to use 'none' for the user-info signing algorithm");
            }
            return StringUtils.isNotBlank(service.getUserInfoSigningAlg())
                   && !Strings.CI.equals(service.getUserInfoSigningAlg(), AlgorithmIdentifiers.NONE);
        }
        return false;
    }

    @Override
    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {
        if (registeredService instanceof final OidcRegisteredService service) {

            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())
                && !discoverySettings.getUserInfoEncryptionAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {
                LOGGER.error("Service [{}] has defined 'none' for user-info encryption algorithm, "
                             + "yet CAS is configured to support the following encryption algorithms: [{}]. "
                             + "This is quite likely due to misconfiguration of the CAS server or the service definition",
                    registeredService.getServiceId(), discoverySettings.getUserInfoEncryptionAlgValuesSupported());
                throw new IllegalArgumentException("Unable to use 'none' as user-info encryption algorithm");

View on GitHub (pinned to e7288fc434)