{"record":{"id":"5436cac12e98ec43","repo":"apereo/cas","slug":"unable-to-use-none-as-introspection-signing-algo","errorCode":null,"errorMessage":"Unable to use 'none' as introspection signing algorithm","messagePattern":"Unable to use 'none' as introspection signing algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java","lineNumber":61,"sourceCode":"    public String getJsonWebKeySigningAlgorithm(final OAuthRegisteredService registeredService,\n                                                final JsonWebKey jsonWebKey) {\n        return StringUtils.defaultIfBlank(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.RSA_USING_SHA512);\n    }\n\n    @Override\n    protected String getSigningMediaType() {\n        return MediaType.parseMediaType(OAuth20Constants.INTROSPECTION_JWT_HEADER_CONTENT_TYPE).getSubtype();\n    }\n\n    @Override\n    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {\n        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionSignedResponseAlg())\n            && !discoverySettings.getIntrospectionSignedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n            LOGGER.error(\"Service [{}] has defined 'none' for introspection signing algorithm, \"\n                    + \"yet CAS is configured to support the following signing algorithms: [{}]. \"\n                    + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                registeredService.getServiceId(), discoverySettings.getIntrospectionSignedResponseAlgValuesSupported());\n            throw new IllegalArgumentException(\"Unable to use 'none' as introspection signing algorithm\");\n        }\n        return StringUtils.isNotBlank(registeredService.getIntrospectionSignedResponseAlg())\n            && !Strings.CI.equals(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.NONE);\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionEncryptedResponseAlg())\n            && !discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n            LOGGER.error(\"Service [{}] has defined 'none' for introspection encryption algorithm, \"\n                    + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                    + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                registeredService.getServiceId(), discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported());\n            throw new IllegalArgumentException(\"Unable to use 'none' as introspection encryption algorithm\");\n        }\n        return StringUtils.isNotBlank(registeredService.getIntrospectionEncryptedResponseAlg())\n            && !Strings.CI.equals(registeredService.getIntrospectionEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);\n    }","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java#L43-L79","documentation":"OidcTokenIntrospectionSigningAndEncryptionService.shouldSignToken throws when a registered service declares introspectionSignedResponseAlg='none' but CAS discovery metadata does not advertise 'none' as a supported introspection signing algorithm. The configuration is contradictory — the service asks for unsigned introspection responses the server does not allow — so CAS rejects it as a misconfiguration rather than producing an unsigned token.","triggerScenarios":"Registering an OIDC service with introspectionSignedResponseAlg='none' while cas.authn.oidc.discovery.introspectionSignedResponseAlgValuesSupported omits 'none', then triggering token introspection.","commonSituations":"Copying a service definition from another CAS deployment with different discovery settings; forgetting that 'none' must be explicitly enabled in discovery supported values; tightening security settings after services already specified 'none'.","solutions":["Add 'none' to cas.authn.oidc.discovery.introspectionSignedResponseAlgValuesSupported if unsigned introspection is truly desired.","Otherwise change the service definition's introspectionSignedResponseAlg to a supported algorithm such as RS256.","Leave introspectionSignedResponseAlg blank to use CAS defaults instead of 'none'.","Align service registration JSON with the discovery configuration before re-running introspection."],"exampleFix":"// before (service JSON)\n\"introspectionSignedResponseAlg\": \"none\"\n// after\n\"introspectionSignedResponseAlg\": \"RS256\"","handlingStrategy":"validation","validationCode":"String alg = service.getIntrospectionSignedResponseAlg();\nList<String> supported = discoverySettings.getIntrospectionSignedResponseAlgValuesSupported();\nif (\"none\".equalsIgnoreCase(alg) && !supported.contains(\"none\")) {\n    throw new IllegalStateException(\"'none' not supported for introspection signing\");\n}","typeGuard":null,"tryCatchPattern":"try { introspectionService.shouldSignToken(service, discovery); } catch (IllegalArgumentException e) {\n    LOGGER.error(\"Fix service {} signing alg\", service.getServiceId(), e);\n}","preventionTips":["Keep service definitions and discovery algorithm lists in sync via review checklist","Prefer leaving alg unset over specifying 'none'","Validate service JSON against discovery settings at registration time"],"tags":["oidc","introspection","signing","misconfiguration","none-alg"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}