{"record":{"id":"23e96c34d7f071fe","repo":"keycloak/keycloak","slug":"no-provider-for-alg","errorCode":null,"errorMessage":"No provider for alg ","messagePattern":"No provider for alg ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/keycloak/jose/jwe/JWE.java","lineNumber":188,"sourceCode":"\n    private void setupJWEHeader(String jweStr) throws IllegalStateException {\n        String[] parts = jweStr.split(\"\\\\.\");\n        if (parts.length != 5) {\n            throw new IllegalStateException(\"Not a JWE String\");\n        }\n\n        this.base64Header = parts[0];\n        this.base64Cek = parts[1];\n        this.initializationVector = Base64Url.decode(parts[2]);\n        this.encryptedContent = Base64Url.decode(parts[3]);\n        this.authenticationTag = Base64Url.decode(parts[4]);\n\n        this.header = (JWEHeader) getHeader();\n    }\n\n    private JWE getProcessedJWE(JWEAlgorithmProvider algorithmProvider, JWEEncryptionProvider encryptionProvider) throws Exception {\n        if (algorithmProvider == null) {\n            throw new IllegalArgumentException(\"No provider for alg \");\n        }\n\n        if (encryptionProvider == null) {\n            throw new IllegalArgumentException(\"No provider for enc \");\n        }\n\n        keyStorage.setEncryptionProvider(encryptionProvider);\n\n        byte[] decodedCek = algorithmProvider.decodeCek(Base64Url.decode(base64Cek), keyStorage.getDecryptionKey(), this.header, encryptionProvider);\n        keyStorage.setCEKBytes(decodedCek);\n\n        encryptionProvider.verifyAndDecodeJwe(this);\n\n        return this;\n    }\n\n    public JWE verifyAndDecodeJwe(String jweStr) throws JWEException {\n        try {","sourceCodeStart":170,"sourceCodeEnd":206,"githubUrl":"https://github.com/keycloak/keycloak/blob/66c7e15a3788de7764f07dd2558275a02770e16d/core/src/main/java/org/keycloak/jose/jwe/JWE.java#L170-L206","documentation":"Thrown by JWE.getProcessedJWE (the decode path) when algorithmProvider is null. Unlike the encode path (error 246), this message is a static literal 'No provider for alg ' with a trailing space and does NOT interpolate the offending algorithm value — so it does not tell you which alg failed. The provider is null because header.getAlgorithm() did not resolve via JWERegistry.getAlgProvider, or the caller of verifyAndDecodeJwe(token, algProvider, encProvider) passed null.","triggerScenarios":"Decoding a JWE whose header 'alg' is not 'dir' and not registered with the crypto provider; or calling the explicit-provider verifyAndDecodeJwe overload with a null algorithmProvider.","commonSituations":"Receiving a JWE encrypted with an algorithm the runtime does not support (e.g. an ECDH-ES variant on a build without the corresponding crypto provider), or downgrading a Keycloak build that dropped an algorithm.","solutions":["Inspect jwe.getHeader().getAlgorithm() (or the raw token's first segment) to identify the alg value that failed to resolve.","Ensure the crypto provider that registers the required algorithm is active (e.g. FIPS/bcfips for RSA-OAEP-256).","If using the explicit-provider overload, pass a non-null algorithmProvider.","Note the message bug (missing alg name) and rely on header inspection rather than the exception text."],"exampleFix":"// before\nJWE jwe = new JWE(token);\njwe.verifyAndDecodeJwe(); // alg unknown -> generic message\n\n// after\nJWE jwe = new JWE(token);\nString alg = jwe.getHeader().getAlgorithm();\nJWEAlgorithmProvider algProvider = JWERegistry.getAlgProvider(alg);\nif (algProvider == null) {\n    throw new UnsupportedAlgorithmException(\"Unsupported JWE alg: \" + alg);\n}\njwe.verifyAndDecodeJwe(token, algProvider, encProvider);","handlingStrategy":"validation","validationCode":"public static void assertAlgResolvable(JWE jwe) {\n    String alg = jwe.getHeader().getAlgorithm();\n    if (JWERegistry.getAlgProvider(alg) == null) {\n        throw new UnsupportedAlgorithmException(\"No JWE alg provider for: \" + alg);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    jwe.verifyAndDecodeJwe();\n} catch (JWEException e) {\n    Throwable c = e.getCause();\n    if (c instanceof IllegalArgumentException && c.getMessage().startsWith(\"No provider for alg\")) {\n        // note: the library message does NOT include the alg value\n        String alg = jwe.getHeader().getAlgorithm();\n        throw new UnsupportedAlgorithmException(\"Unsupported JWE alg on decode: \" + alg, c);\n    }\n    throw e;\n}","preventionTips":["Inspect jwe.getHeader().getAlgorithm() yourself — the decode-path message omits the algorithm name (library bug).","Ensure the crypto provider that registered the algorithm is active in the runtime.","Pass explicit non-null providers to verifyAndDecodeJwe(token, algProvider, encProvider) when you control them."],"tags":["jose","jwe","decryption","algorithm","provider","keycloak"],"backgroundTag":null,"analyzedSha":"66c7e15a3788de7764f07dd2558275a02770e16d","analyzedAt":"2026-08-14T01:36:42.651Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}