{"record":{"id":"6c8ce04656b4a777","repo":"apereo/cas","slug":"encrypted-method-is-not-supported-for-algorit","errorCode":null,"errorMessage":"Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]","messagePattern":"Encrypted method \\[(.+?)\\] is not supported for algorithm \\[(.+?)\\]\\. Accepted methods are \\[(.+?)\\]","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jwt/GenerateJwtCommand.java","lineNumber":152,"sourceCode":"            }))\n            .collect(Collectors.joining(\",\"));\n        LOGGER.debug(\"Encryption algorithm: [{}]. Available algorithms are [{}]\", encryptionAlgorithm, acceptedEncAlgs);\n\n        val acceptedEncMethods = Arrays.stream(EncryptionMethod.class.getDeclaredFields())\n            .filter(f -> f.getType().equals(EncryptionMethod.class))\n            .map(Unchecked.function(f -> {\n                f.setAccessible(true);\n                return ((Algorithm) f.get(null)).getName();\n            }))\n            .collect(Collectors.joining(\",\"));\n        LOGGER.debug(\"Encryption method: [{}]. Available methods are [{}]\", encryptionMethod, acceptedEncMethods);\n\n        val algorithm = JWEAlgorithm.parse(encryptionAlgorithm);\n        val encryptionMethodAlg = EncryptionMethod.parse(encryptionMethod);\n\n        if (DirectCryptoProvider.SUPPORTED_ALGORITHMS.contains(algorithm)\n            && !DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(encryptionMethodAlg)) {\n            LOGGER.warn(\"Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]\",\n                encryptionMethod, encryptionAlgorithm, DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);\n            return;\n        }\n        if (AESCryptoProvider.SUPPORTED_ALGORITHMS.contains(algorithm)\n            && !AESCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(encryptionMethodAlg)) {\n            LOGGER.warn(\"Encrypted method [{}] is not supported for algorithm [{}]. Accepted methods are [{}]\",\n                encryptionMethod, encryptionAlgorithm, AESCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);\n            return;\n        }\n        g.setEncryptionConfiguration(new SecretEncryptionConfiguration(encryptionSecret, algorithm, encryptionMethodAlg));\n    }\n\n    private static void configureJwtSigning(final int signingSecretSize, final String signingAlgorithm, final JwtGenerator g) {\n        if (signingSecretSize <= 0 || StringUtils.isBlank(signingAlgorithm)) {\n            LOGGER.info(\"No signing algorithm or size specified, so the generated JWT will not be encrypted\");\n            return;\n        }\n","sourceCodeStart":134,"sourceCodeEnd":170,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-shell-core/src/main/java/org/apereo/cas/shell/commands/jwt/GenerateJwtCommand.java#L134-L170","documentation":"GenerateJwtCommand.configureJwtEncryption validates the requested JWE algorithm/encryption-method pair against Nimbus JOSE JWT provider constants. If the algorithm is one supported by DirectCryptoProvider but the encryption method is not among DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS, it logs this warning and returns without setting encryption configuration, so the JWT is generated unencrypted (or generation proceeds without the requested encryption).","triggerScenarios":"Running the generate-jwt shell command with --encryption-algorithm set to a direct (dir) style algorithm while passing an encryption method incompatible with it, e.g. 'dir' with A256GCM or a RSA-only method.","commonSituations":"Copy-pasting method names between RSA/AES/direct configurations; typos like 'A256CBC-HS512' with wrong casing; assuming any standard EncryptionMethod works with any algorithm.","solutions":["Use a method from DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS (printed in the warning) with the direct algorithm.","If you need AES-CBC/GCM methods, switch the algorithm to one in AESCryptoProvider.SUPPORTED_ALGORITHMS (see the next check).","Verify the --encryption-method value matches a Nimbus EncryptionMethod name exactly."],"exampleFix":"// before\n--encryption-algorithm dir --encryption-method A256GCM\n// after\n--encryption-algorithm dir --encryption-method A128CBC-HS256","handlingStrategy":"validation","validationCode":"JWEAlgorithm alg = JWEAlgorithm.parse(encryptionAlgorithm);\nEncryptionMethod method = EncryptionMethod.parse(encryptionMethod);\nif (DirectCryptoProvider.SUPPORTED_ALGORITHMS.contains(alg)\n    && !DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.contains(method)) {\n    throw new IllegalArgumentException(\"dir algorithm requires method in \" + DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pair 'dir' only with methods listed in DirectCryptoProvider.SUPPORTED_ENCRYPTION_METHODS.","Check the warning output — it prints the accepted methods.","Use Nimbus' JWE algorithm/method compatibility table when composing options."],"tags":["jwt","jwe","nimbus","cli","encryption"],"backgroundTag":"invalid-enum-argument","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}