{"record":{"id":"3ea26094af726d1d","repo":"apereo/cas","slug":"public-key-located-from-keystore-for-key-id-is-un","errorCode":null,"errorMessage":"Public key located from keystore for key id  is undefined","messagePattern":"Public key located from keystore for key id  is undefined","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java","lineNumber":108,"sourceCode":"        configureEncryptionParametersForEncoding();\n        return super.encode(value, parameters);\n    }\n\n    @Override\n    public String decode(final Serializable value, final Object[] parameters) {\n        configureSigningParametersForDecoding();\n        configureEncryptionParametersForDecoding();\n        return super.decode(value, parameters);\n    }\n\n    private void configureSigningParametersForDecoding() {\n        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());\n        if (result.isEmpty()) {\n            throw new IllegalArgumentException(\"Could not locate RSA JSON web key from keystore\");\n        }\n        val key = result.get();\n        if (key.getPublicKey() == null) {\n            throw new IllegalArgumentException(\"Public key located from keystore for key id \" + key.getKeyId() + \" is undefined\");\n        }\n        setSigningKey(key.getPublicKey());\n    }\n\n    private void configureEncryptionParametersForDecoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();\n                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);\n\n                if (encKeyResult.isEmpty()) {\n                    throw new IllegalArgumentException(\"Could not locate RSA JSON web key from endpoint\");\n                }\n                val encKey = encKeyResult.get();\n                if (encKey.getPrivateKey() == null) {\n                    throw new IllegalArgumentException(\"Private key located from endpoint for key id \" + encKey.getKeyId() + \" is undefined\");","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java#L90-L126","documentation":"The RSA JWK found in the keystore for signature verification has no public key component, so it cannot be used to verify signatures; IllegalArgumentException aborts decode configuration. The input at fault is the JWK entry identified by its key id in the configured webKeySet.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:108 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace the JWK entry with a complete key pair containing the public component ('n','e')","Regenerate the keystore JWKS with jose libraries or CAS key tooling","Verify the JWKS file was not truncated or hand-edited"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}