{"record":{"id":"63a65f716d6964d5","repo":"apereo/cas","slug":"private-key-located-from-keystore-for-key-id-is-u","errorCode":null,"errorMessage":"Private key located from keystore for key id  is undefined","messagePattern":"Private key located from keystore for key id  is undefined","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java","lineNumber":164,"sourceCode":"                val encKey = encKeyResult.get();\n                if (encKey.getPublicKey() == null) {\n                    throw new IllegalArgumentException(\"Public key from endpoint for key id \" + encKey.getKeyId() + \" is undefined\");\n                }\n                setEncryptionKey(encKey.getPublicKey());\n                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);\n                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);\n            }\n        });\n    }\n\n    private void configureSigningParametersForEncoding() {\n        val result = findRsaJsonWebKeyByProvidedKeyId(webKeySet.getJsonWebKeys());\n        if (result.isEmpty()) {\n            throw new IllegalArgumentException(\"Could not locate RSA JSON web key from keystore\");\n        }\n        val key = result.get();\n        if (key.getPrivateKey() == null) {\n            throw new IllegalArgumentException(\"Private key located from keystore for key id \" + key.getKeyId() + \" is undefined\");\n        }\n        setSigningKey(key.getPrivateKey());\n    }\n\n    private Optional<RsaJsonWebKey> findRsaJsonWebKeyByProvidedKeyId(final List<JsonWebKey> keys) {\n        val predicate = this.keyIdToUse\n            .<Predicate<JsonWebKey>>map(s -> jsonWebKey -> jsonWebKey.getKeyId()\n                .equalsIgnoreCase(s))\n            .orElseGet(() -> jsonWebKey -> true);\n        return findRsaJsonWebKey(keys, predicate);\n    }\n}\n","sourceCodeStart":146,"sourceCodeEnd":177,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java#L146-L177","documentation":"While preparing encoding (signing) parameters, the RSA JWK found in the local keystore for the configured key id has no private key, so payloads cannot be signed; IllegalArgumentException aborts encode configuration. The input at fault is the keystore JWK entry — a public-only key was supplied where a signing (private) key is required.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:164 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the full JWK key pair including the private key ('d') in the keystore","Regenerate the signing key pair and reload the keystore","Point the executor at the keystore variant that contains private key material"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}