{"record":{"id":"49a92d1430159110","repo":"apereo/cas","slug":"unable-to-use-none-for-the-user-info-signing-alg","errorCode":null,"errorMessage":"Unable to use 'none' for the user-info signing algorithm","messagePattern":"Unable to use 'none' for the user-info signing algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java","lineNumber":65,"sourceCode":"    @Override\n    public String getJsonWebKeySigningAlgorithm(final OAuthRegisteredService registeredService,\n                                                final JsonWebKey jsonWebKey) {\n        if (registeredService instanceof final OidcRegisteredService oidcService) {\n            return oidcService.getUserInfoSigningAlg();\n        }\n        return super.getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey);\n    }\n\n    @Override\n    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoSigningAlg())\n                && !discoverySettings.getUserInfoSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                LOGGER.error(\"Service [{}] has defined 'none' for user-info signing algorithm, \"\n                             + \"yet CAS is configured to support the following signing algorithms: [{}]. \"\n                             + \"This is quite likely due to misconfiguration of the CAS server or the service definition.\",\n                    registeredService.getServiceId(), discoverySettings.getUserInfoSigningAlgValuesSupported());\n                throw new IllegalArgumentException(\"Unable to use 'none' for the user-info signing algorithm\");\n            }\n            return StringUtils.isNotBlank(service.getUserInfoSigningAlg())\n                   && !Strings.CI.equals(service.getUserInfoSigningAlg(), AlgorithmIdentifiers.NONE);\n        }\n        return false;\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n\n            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getUserInfoEncryptedResponseAlg())\n                && !discoverySettings.getUserInfoEncryptionAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                LOGGER.error(\"Service [{}] has defined 'none' for user-info encryption algorithm, \"\n                             + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                             + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                    registeredService.getServiceId(), discoverySettings.getUserInfoEncryptionAlgValuesSupported());\n                throw new IllegalArgumentException(\"Unable to use 'none' as user-info encryption algorithm\");","sourceCodeStart":47,"sourceCodeEnd":83,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcUserProfileSigningAndEncryptionService.java#L47-L83","documentation":"OidcUserProfileSigningAndEncryptionService.shouldSignToken throws this when a registered OIDC service sets its userinfo signing algorithm to 'none' (unsigned), but the CAS server's discovery metadata does not advertise 'none' among supported userinfo signing alg values. It signals a mismatch between the service definition and server configuration, so CAS refuses rather than silently issuing an unsigned response.","triggerScenarios":"A registered service has cas/service/oidc user-info signing alg set to 'none' while discoverySettings.getUserInfoSigningAlgValuesSupported() (from cas.authn.oidc.core.user-info-signing-alg-values-supported or defaults) does not include 'none'; shouldSignToken is invoked when building a userinfo response for that service.","commonSituations":"Admin sets userinfo signing alg to 'none' in the service registry but forgets to add 'none' to the server's supported signing algorithm list; server upgraded and defaults no longer include 'none'; copy-pasted service definition from another CAS instance with different discovery config.","solutions":["Add 'none' to cas.authn.oidc.core.user-info-signing-alg-values-supported in CAS properties if unsigned userinfo responses are truly desired","Or change the service definition's userinfo signing algorithm to a supported value like RS256","Review discovery metadata at /.well-known/openid-configuration to confirm which userinfo signing algs the server advertises"],"exampleFix":"// before (service definition)\n\"userInfoSigningAlg\": \"none\"\n// after (cas.properties, if 'none' is intended)\ncas.authn.oidc.core.user-info-signing-alg-values-supported=RS256,ES256,none\n// or change the service definition\n\"userInfoSigningAlg\": \"RS256\"","handlingStrategy":"validation","validationCode":"var supported = discoveryMetadata.getUserInfoSigningAlgValuesSupported();\nif (\"none\".equalsIgnoreCase(service.getUserInfoSigningAlg()) && !supported.contains(\"none\")) {\n    throw new IllegalStateException(\"Service \" + service.getServiceId() + \" requests 'none' userinfo signing but server supports only \" + supported);\n}","typeGuard":null,"tryCatchPattern":"try { profileService.shouldSignToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error(\"Fix service userinfo signing alg or CAS discovery config: {}\", e.getMessage()); }","preventionTips":["Keep service userinfo signing alg within the algs advertised in /.well-known/openid-configuration","Validate service definitions against discovery metadata at import time","Document the pairing of cas.authn.oidc.core.*-supported lists with service registry values"],"tags":["oidc","configuration","misconfiguration","signing"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}