{"record":{"id":"4410fe7707fca783","repo":"apereo/cas","slug":"unable-to-use-none-as-user-info-encryption-algor","errorCode":null,"errorMessage":"Unable to use 'none' as user-info encryption algorithm","messagePattern":"Unable to use 'none' as user-info encryption algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java","lineNumber":83,"sourceCode":"                throw new IllegalArgumentException(\"Unable to use 'none' for the user-info signing algorithm\");\n            }\n            return StringUtils.isNotBlank(service.getUserInfoSigningAlg())\n                   && !Strings.CI.equals(service.getUserInfoSigningAlg(), AlgorithmIdentifiers.NONE);\n        }\n        return false;\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n\n            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())\n                && !discoverySettings.getUserInfoEncryptionAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                LOGGER.error(\"Service [{}] has defined 'none' for user-info encryption algorithm, \"\n                             + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                             + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                    registeredService.getServiceId(), discoverySettings.getUserInfoEncryptionAlgValuesSupported());\n                throw new IllegalArgumentException(\"Unable to use 'none' as user-info encryption algorithm\");\n            }\n            return StringUtils.isNotBlank(service.getUserInfoEncryptedResponseAlg())\n                   && !Strings.CI.equals(service.getUserInfoEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);\n        }\n        return false;\n    }\n\n    @Override\n    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {\n        return this.discoverySettings.getUserInfoSigningAlgValuesSupported();\n    }\n\n    @Override\n    protected String encryptToken(final OAuthRegisteredService service,\n                                  final String innerJwt) {\n        if (service instanceof final OidcRegisteredService svc) {\n            val jsonWebKey = getJsonWebKeyForEncryption(svc);\n            return JsonWebTokenEncryptor.builder()","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java#L65-L101","documentation":"OidcUserProfileSigningAndEncryptionService.shouldEncryptToken throws this when a registered service sets its userinfo encrypted-response alg to 'none' while the server's discovery settings do not list 'none' as a supported userinfo encryption alg. Since 'none' is not a meaningful encryption algorithm, this always indicates misconfiguration of the server or the service definition.","triggerScenarios":"registeredService.getUserInfoEncryptedResponseAlg() equals 'none' (case-insensitive) and discoverySettings.getUserInfoEncryptionAlgValuesSupported() does not contain 'none'; evaluated while preparing an encrypted userinfo response.","commonSituations":"Admin typo'd or misread the encryption alg field and put 'none' (a signing-only value) into the encryption field; service definition template reused without adjusting encryption settings.","solutions":["Set the service's userinfo encryption alg to a real algorithm (e.g. RSA-OAEP-256, RSA1_5, dir) that the server supports","If no encryption is wanted, clear the userinfo encrypted-response alg (leave blank) instead of using 'none'","Verify cas.authn.oidc.core user-info encryption alg values supported in CAS properties"],"exampleFix":"// before (service definition)\n\"userInfoEncryptedResponseAlg\": \"none\"\n// after\n\"userInfoEncryptedResponseAlg\": \"RSA-OAEP-256\"\n// or leave blank to disable encryption","handlingStrategy":"validation","validationCode":"if (\"none\".equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())) {\n    throw new IllegalStateException(\"'none' is not a valid userinfo encryption alg for service \" + service.getServiceId());\n}","typeGuard":null,"tryCatchPattern":"try { profileService.shouldEncryptToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error(\"Service userinfo encryption alg misconfigured: {}\", e.getMessage()); }","preventionTips":["Never put 'none' in any encryption alg field — it is only a signing value","Leave encryption alg blank to disable userinfo encryption","Lint service registry JSON for reserved algorithm values before publishing"],"tags":["oidc","configuration","misconfiguration","encryption"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}