{"record":{"id":"5ae63e30ca08e528","repo":"apereo/cas","slug":"unsupported-key-type","errorCode":null,"errorMessage":"Unsupported key type: ","messagePattern":"Unsupported key type: ","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/jwks/OidcJwksRegistrationEndpointController.java","lineNumber":111,"sourceCode":"        val audit = AuditableContext.builder()\n            .registeredService(registeredService)\n            .authentication(accessTokenTicket.getAuthentication())\n            .build();\n        val accessResult = configurationContext.getRegisteredServiceAccessStrategyEnforcer().execute(audit);\n        accessResult.throwExceptionIfNeeded();\n        \n        val jws = JWSObject.parse(registrationRequest.proof());\n\n        val alg = jws.getHeader().getAlgorithm();\n        FunctionUtils.throwIf(!JWSAlgorithm.Family.EC.contains(alg) && !JWSAlgorithm.Family.RSA.contains(alg) && !JWSAlgorithm.EdDSA.equals(alg),\n            () -> new ResponseStatusException(HttpStatus.UNAUTHORIZED, \"Invalid algorithm: \" + alg));\n\n        val jwk = jws.getHeader().getJWK();\n        val verifier = switch (jwk) {\n            case ECKey ecKey -> new ECDSAVerifier(ecKey);\n            case RSAKey rsaKey -> new RSASSAVerifier(rsaKey);\n            case OctetKeyPair okp -> new Ed25519Verifier(okp.toPublicJWK());\n            default -> throw new IllegalArgumentException(\"Unsupported key type: \" + jwk.getKeyType());\n        };\n        if (!jws.verify((JWSVerifier) verifier)) {\n            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, \"Invalid signature\");\n        }\n        val jkt = jwk.computeThumbprint().toString();\n        clientJwksRegistrationStore.save(accessTokenTicket.getClientId(), jkt, jwk.toPublicJWK().toJSONString());\n        return ResponseEntity.ok(new ClientJwksRegistrationResponse(jkt));\n    }\n\n    /**\n     * Handle errors.\n     *\n     * @param ex the ex\n     * @return the response entity\n     */\n    @ExceptionHandler(Exception.class)\n    @SuppressWarnings(\"UnusedMethod\")\n    private static ResponseEntity<String> handle(final Exception ex) {","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/web/controllers/jwks/OidcJwksRegistrationEndpointController.java#L93-L129","documentation":"The signed client JWKS registration request JWT must be signed with a supported key type. The controller matches the embedded JWK with a pattern switch supporting EC, RSA, and Octet Key Pair (Ed25519) keys; any other key type (e.g. 'oct' symmetric keys) causes an IllegalArgumentException naming the key type.","triggerScenarios":"handleRegistration(): the JWS header's embedded JWK is not an ECKey, RSAKey, or OctetKeyPair — e.g. a symmetric 'oct' key or an unsupported curve/algorithm — so the switch falls to the default branch.","commonSituations":"Signing the registration JWT with an HMAC/shared secret ('oct' key) instead of an asymmetric key; generating the JWK with an unsupported OKP curve other than Ed25519; client library defaulting to a key type CAS does not accept.","solutions":["Sign the registration JWT with an RSA, EC (P-256 etc.), or Ed25519 (OctetKeyPair) key and embed that JWK in the JWS header","Replace any symmetric 'oct' key with an asymmetric keypair","Regenerate the client key with a supported algorithm and retry the registration"],"exampleFix":"// before: HMAC-signed JWS with oct key in header\nJWSSigner signer = new MACSigner(sharedSecret);\n// after: RSA-signed JWS with RSAKey in header\nRSAKey rsaJwk = new RSAKeyGenerator(2048).generate();\nJWSSigner signer = new RSASSASigner(rsaJwk);","handlingStrategy":"validation","validationCode":"JWK jwk = parsedJws.getHeader().getJWK();\nif (!(jwk instanceof ECKey) && !(jwk instanceof RSAKey) && !(jwk instanceof OctetKeyPair)) {\n    throw new IllegalArgumentException(\"key type not supported: \" + jwk.getKeyType());\n}","typeGuard":"boolean supported = jwk instanceof ECKey || jwk instanceof RSAKey || jwk instanceof OctetKeyPair;","tryCatchPattern":"try { controller.handleRegistration(request, response); }\ncatch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Unsupported key type\")) { /* re-sign JWT with RSA/EC/Ed25519 key */ }\n    else throw e;\n}","preventionTips":["Use RSA, EC, or Ed25519 keys for client JWKS registration JWTs","Never use symmetric 'oct' keys for this endpoint","Check the generated JWK's kty before embedding it in the JWS header"],"tags":["oidc","jwks","jws","unsupported-key-type","crypto"],"backgroundTag":"unsupported-enum-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}