{"record":{"id":"0d8e322a02b7a9ae","repo":"quarkusio/quarkus","slug":"unsupported-signature-algorithm","errorCode":null,"errorMessage":"Unsupported signature algorithm","messagePattern":"Unsupported signature algorithm","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":584,"sourceCode":"\n        if (key instanceof SecretKey) {\n            return jwtSignatureBuilder.sign((SecretKey) key);\n        } else {\n            return jwtSignatureBuilder.sign((PrivateKey) key);\n        }\n    }\n\n    @SuppressWarnings({ \"unchecked\", \"rawtypes\" })\n    private static Map<String, Object> additionalClaims(Map<String, String> claims) {\n        return (Map) claims;\n    }\n\n    private static SignatureAlgorithm getSignatureAlgorithm(Credentials credentials, SignatureAlgorithm defaultAlgorithm) {\n        if (credentials.jwt().signatureAlgorithm().isPresent()) {\n            try {\n                return SignatureAlgorithm.fromAlgorithm(credentials.jwt().signatureAlgorithm().get());\n            } catch (Exception ex) {\n                throw new ConfigurationException(\"Unsupported signature algorithm\");\n            }\n        } else {\n            return defaultAlgorithm;\n        }\n    }\n\n    public static void verifyConfigurationId(String defaultId, String configKey, Optional<String> configId) {\n        if (configKey.equals(defaultId)) {\n            throw new ConfigurationException(\"configuration id '\" + configKey + \"' duplicates the default configuration id\");\n        }\n        if (configId.isPresent() && !configKey.equals(configId.get())) {\n            throw new ConfigurationException(\"Configuration has 2 different id values: '\"\n                    + configKey + \"' and '\" + configId.get() + \"'\");\n        }\n\n    }\n\n    public static String initClientSecretBasicAuth(OidcClientCommonConfig oidcConfig, String clientSecret) {","sourceCodeStart":566,"sourceCodeEnd":602,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L566-L602","documentation":"The configured JWT signature algorithm string could not be parsed into a known JOSE SignatureAlgorithm. Quarkus validates quarkus.oidc-client.credentials.jwt.signature-algorithm at startup and rejects unknown/unsupported values.","triggerScenarios":"credentials.jwt.signature-algorithm set to a value not recognized by SignatureAlgorithm.fromAlgorithm — misspelling, wrong casing, or an algorithm (e.g. PS512, EdDSA in older JOSE4j) the underlying implementation does not support.","commonSituations":"Copying an algorithm name from provider docs using non-standard spelling ('HS256 ' with whitespace, 'ES256K'); upgrading/downgrading Quarkus changes the supported algorithm set; typos like 'HS245'.","solutions":["Set the property to a supported value: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 (as supported by the underlying JOSE library)","Remove the property to use the default algorithm chosen for the configured key type","Check the Quarkus version's supported SignatureAlgorithm enum if an algorithm is rejected","Trim whitespace/quotes around the configured value"],"exampleFix":"// before\nquarkus.oidc-client.credentials.jwt.signature-algorithm=ES256K\n// after\nquarkus.oidc-client.credentials.jwt.signature-algorithm=ES256","handlingStrategy":"validation","validationCode":"Set<String> supported = Set.of(\"HS256\",\"HS384\",\"HS512\",\"RS256\",\"RS384\",\"RS512\",\"ES256\",\"ES384\",\"ES512\",\"PS256\",\"PS384\",\"PS512\");\nString alg = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.signature-algorithm\", String.class).orElse(\"\");\nif (!alg.isEmpty() && !supported.contains(alg.trim())) throw new IllegalStateException(\"Unsupported signature algorithm: \" + alg);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use exact uppercase JOSE algorithm names","Match the algorithm to the configured key type (RSA -> RS*/PS*, EC -> ES*, secret -> HS*)","Check the JOSE4j/Quarkus version support before using newer algorithms"],"tags":["oidc","jwt","config","algorithm"],"backgroundTag":"invalid-signature-algorithm","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}