apereo/cas · error · IllegalArgumentException

Unable to verify JWT assertion with any of the configured…

Error message

Unable to verify JWT assertion with any of the configured JSON web keys

What it means

verifyAssertion tries to verify the signed JWT assertion against each configured JSON web key (JWK). Each failure is logged at debug and skipped; if no key verifies the signature, it throws IllegalArgumentException 'Unable to verify JWT assertion with any of the configured JSON web keys'.

Solutions

Verify the JWKS/keystore configured for the parser contains the public key matching the assertion's kid
Refresh/re-import the issuer's JWKS (keys may have rotated)
Confirm the assertion is signed with the expected algorithm and by the registered issuer/client
Enable debug logging for org.apereo.cas.heimdall to see the per-key failure reasons

Example fix

// before: keystore missing rotated key
// after: reload JWKS from issuer endpoint / update registered key material
cas.authn.heimdall... update jwt keystore to current issuer JWKS

Defensive patterns

Strategy: validation

Validate before calling

// ensure the assertion kid exists in the configured keystore before verification
String kid = signedJWT.getHeader().getKeyID();
boolean keyKnown = jwks.getKeys().stream().anyMatch(k -> kid.equals(k.getKeyID()));

Try / catch

try {
    return parser.claims(token);
} catch (IllegalArgumentException e) {
    // refresh JWKS from issuer then retry once; else reject 401
}

Prevention

Automate JWKS refresh to track issuer key rotation
Ensure assertions always carry a kid matching a registered key
Log per-key verification failures at debug to diagnose mismatches

When it happens

Trigger: verifiedAssertion -> verifyAssertion called with a JWT whose signature does not validate under any key in the Heimdall/JWKS keystore (wrong kid, wrong key set, or tampered token).

Common situations: JWKS rotation left the server without the new key; assertion signed by a different issuer key than the one registered; kid missing from the keystore config; assertion modified in transit; wrong algorithm (HS vs RS) configured.

Related errors

AI-assisted analysis of apereo/cas@e7288fc434 (2026-09-08). Data as JSON: /api/errors/c5bce7305292c220. Report an issue: GitHub.

Appendix: source

Thrown at support/cas-server-support-heimdall/src/main/java/org/apereo/cas/heimdall/engine/DefaultAuthorizationPrincipalParser.java:227

            .filter(PublicJsonWebKey.class::isInstance)
            .filter(key -> key.getKey() != null)
            .map(PublicJsonWebKey.class::cast)
            .toList();
    }

    protected String verifyAssertion(final String assertion, final List<PublicJsonWebKey> jsonWebKeys) {
        for (val jsonWebKey : jsonWebKeys) {
            try {
                val verified = EncodingUtils.verifyJwsSignature(jsonWebKey.getPublicKey(), assertion);
                val verifiedAssertion = new String(verified, StandardCharsets.UTF_8);
                LOGGER.trace("Successfully verified JWT assertion with key id [{}]", jsonWebKey.getKeyId());
                return verifiedAssertion;
            } catch (final Exception e) {
                LOGGER.debug("Failed to verify JWT assertion via key id [{}]: [{}]. Moving on to the next key",
                    jsonWebKey.getKeyId(), e.getMessage());
            }
        }
        throw new IllegalArgumentException("Unable to verify JWT assertion with any of the configured JSON web keys");
    }
}

View on GitHub (pinned to e7288fc434)