{"record":{"id":"0ef9e4e280127c78","repo":"apereo/cas","slug":"encryption-signing-is-not-enabled-explicitly-in-th-0ef9e4","errorCode":null,"errorMessage":"Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.","messagePattern":"Encryption/Signing is not enabled explicitly in the configuration for cookie \\[(.+?)\\], yet signing/encryption keys are defined for operations\\. CAS will proceed to enable the cookie encryption/signing functionality\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"info","filePath":"support/cas-server-support-saml-idp/src/main/java/org/apereo/cas/config/SamlIdPEndpointsConfiguration.java","lineNumber":488,"sourceCode":"                        Strings.CI.prependIfMissing(SamlIdPConstants.BASE_ENDPOINT_SAML2, \"/\"));\n                }\n            };\n        }\n\n        @ConditionalOnMissingBean(name = \"samlIdPDistributedSessionCookieCipherExecutor\")\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @Bean\n        @Deprecated(since = \"7.3.0\", forRemoval = true)\n        public CipherExecutor samlIdPDistributedSessionCookieCipherExecutor(final CasConfigurationProperties casProperties) {\n            val type = casProperties.getAuthn().getSamlIdp().getCore().getSessionStorageType();\n            return FunctionUtils.doIf(type.isTicketRegistry(),\n                () -> {\n                    val cookie = casProperties.getAuthn().getSamlIdp().getCore().getSessionReplication().getCookie();\n                    val crypto = cookie.getCrypto();\n                    var enabled = crypto.isEnabled();\n                    if (!enabled && StringUtils.isNotBlank(crypto.getEncryption().getKey())\n                        && StringUtils.isNotBlank(crypto.getSigning().getKey())) {\n                        LOGGER.warn(\"Encryption/Signing is not enabled explicitly in the configuration for cookie [{}], yet signing/encryption keys \"\n                                    + \"are defined for operations. CAS will proceed to enable the cookie encryption/signing functionality.\", cookie.getName());\n                        enabled = true;\n                    }\n                    return enabled\n                        ? CipherExecutorUtils.newStringCipherExecutor(crypto, SamlIdPDistributedSessionCookieCipherExecutor.class)\n                        : CipherExecutor.noOp();\n                },\n                CipherExecutor::noOp).get();\n        }\n\n        @ConditionalOnMissingBean(name = \"samlIdPDistributedSessionCookieGenerator\")\n        @Bean\n        @RefreshScope(proxyMode = ScopedProxyMode.DEFAULT)\n        @Deprecated(since = \"7.3.0\", forRemoval = true)\n        public CasCookieBuilder samlIdPDistributedSessionCookieGenerator(\n            @Qualifier(TenantExtractor.BEAN_NAME)\n            final TenantExtractor tenantExtractor,\n            @Qualifier(GeoLocationService.BEAN_NAME)","sourceCodeStart":470,"sourceCodeEnd":506,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-saml-idp/src/main/java/org/apereo/cas/config/SamlIdPEndpointsConfiguration.java#L470-L506","documentation":"CAS detects an inconsistent cookie crypto configuration: crypto.enabled is false, but both a signing key and an encryption key are supplied. Rather than silently ignoring the keys, CAS warns and enables encryption/signing for the SAML IdP distributed-session cookie.","triggerScenarios":"cas.authn.saml-idp.session-replication.cookie.crypto.enabled=false while crypto.signing.key and crypto.encryption.key are both set when building samlIdPDistributedSessionCookieCipherExecutor.","commonSituations":"Operator disabled crypto intending to turn it off but left generated keys in config; copied a template with keys present; migration from an older CAS version where keys existed by default.","solutions":["If you want crypto ON: set cas.authn.saml-idp.session-replication.cookie.crypto.enabled=true (behavior already forced anyway).","If you want crypto OFF: remove crypto.signing.key and crypto.encryption.key from configuration.","Ensure all CAS nodes use identical keys, or cluster session replication breaks on decryption.","Note the forced-enable in deployment docs so future operators don't get surprised."],"exampleFix":"// before\ncas.authn.saml-idp.session-replication.cookie.crypto.enabled=false\ncas.authn.saml-idp.session-replication.cookie.crypto.signing.key=abc...\ncas.authn.saml-idp.session-replication.cookie.crypto.encryption.key=xyz...\n// after (crypto intentionally off)\ncas.authn.saml-idp.session-replication.cookie.crypto.enabled=false\n// keys removed","handlingStrategy":"validation","validationCode":"var crypto = props.getAuthn().getSamlIdp().getCore().getSessionReplication().getCookie().getCrypto();\nboolean explicit = crypto.isEnabled();\nboolean hasKeys = isNotBlank(crypto.getSigning().getKey()) && isNotBlank(crypto.getEncryption().getKey());\nif (!explicit && hasKeys) {\n    LOGGER.warn(\"Crypto disabled but keys present — remove keys or enable crypto\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep crypto.enabled consistent with the presence of keys.","Lint startup logs for this warning in CI/health checks.","Use the same key material across all clustered CAS nodes."],"tags":["configuration","crypto","cookie"],"backgroundTag":"conflicting-config-options","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}