{"record":{"id":"5046347d86348ac8","repo":"apereo/cas","slug":"unable-to-use-none-as-id-token-encryption-algori","errorCode":null,"errorMessage":"Unable to use 'none' as ID token encryption algorithm","messagePattern":"Unable to use 'none' as ID token encryption algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java","lineNumber":82,"sourceCode":"                }\n                LOGGER.error(\"Service [{}] has defined 'none' for ID token signing algorithm\", registeredService.getServiceId());\n                return false;\n            }\n            return true;\n        }\n        return false;\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n            if (service.isEncryptIdToken() && AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {\n                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                    LOGGER.error(\"Service [{}] has defined 'none' for ID token encryption algorithm, \"\n                            + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                            + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                        registeredService.getServiceId(), discoverySettings.getIdTokenEncryptionAlgValuesSupported());\n                    throw new IllegalArgumentException(\"Unable to use 'none' as ID token encryption algorithm\");\n                }\n                LOGGER.error(\"Service [{}] has defined 'none' for ID token encryption algorithm\", registeredService.getServiceId());\n                return false;\n            }\n\n            return service.isEncryptIdToken()\n                && StringUtils.isNotBlank(service.getIdTokenEncryptionAlg())\n                && StringUtils.isNotBlank(service.getIdTokenEncryptionEncoding());\n        }\n        return false;\n    }\n\n    @Override\n    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {\n        return this.discoverySettings.getIdTokenSigningAlgValuesSupported();\n    }\n\n    @Override","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java#L64-L100","documentation":"OidcIdTokenSigningAndEncryptionService.shouldEncryptToken throws this when a service with ID token encryption enabled sets its ID token encryption alg to 'none' and the server's discovery settings do not support 'none'. The source also has a likely copy-paste bug: it checks idTokenSigningAlgValuesSupported (signing list) instead of the encryption list, so the guard compares against the wrong set.","triggerScenarios":"service.isEncryptIdToken() is true and service.getIdTokenEncryptionAlg() equals 'none'; discoverySettings.getIdTokenSigningAlgValuesSupported() does not contain 'none'; evaluated while preparing an encrypted ID token.","commonSituations":"Admin mistakenly put 'none' in the encryption alg field (it is only meaningful for signing); service definition templated from a signing-only config; upgrading CAS where the guard logic checks the wrong discovery list.","solutions":["Set the service's ID token encryption alg to a real JWE algorithm (e.g. RSA-OAEP-256, dir) supported by the server","If no encryption is intended, disable encrypt-id-token on the service instead of using 'none' for the alg","As a server-side workaround, include 'none' in the supported signing alg values (the code checks the signing list due to the copy-paste) — better fixed in code by comparing against the encryption list"],"exampleFix":"// before (service definition)\n\"encryptIdToken\": true,\n\"idTokenEncryptionAlg\": \"none\"\n// after\n\"encryptIdToken\": true,\n\"idTokenEncryptionAlg\": \"RSA-OAEP-256\"\n// or disable encryption entirely\n\"encryptIdToken\": false","handlingStrategy":"validation","validationCode":"if (service.isEncryptIdToken() && \"none\".equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {\n    throw new IllegalStateException(\"'none' is not a valid ID token encryption alg; set a JWE alg or disable encryption\");\n}","typeGuard":null,"tryCatchPattern":"try { idTokenService.shouldEncryptToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error(\"ID token encryption alg misconfigured: {}\", e.getMessage()); }","preventionTips":["Use a real JWE alg (RSA-OAEP-256, dir, ECDH-ES) when encryptIdToken is true","Disable encryptIdToken instead of using 'none'","Be aware this code path checks the signing list, not the encryption list — a server-side copy-paste bug worth verifying"],"tags":["oidc","configuration","encryption","id-token"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}