{"record":{"id":"a25a272e7d3073bb","repo":"apereo/cas","slug":"unable-to-use-none-as-introspection-encryption-a","errorCode":null,"errorMessage":"Unable to use 'none' as introspection encryption algorithm","messagePattern":"Unable to use 'none' as introspection encryption algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java","lineNumber":75,"sourceCode":"            LOGGER.error(\"Service [{}] has defined 'none' for introspection signing algorithm, \"\n                    + \"yet CAS is configured to support the following signing algorithms: [{}]. \"\n                    + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                registeredService.getServiceId(), discoverySettings.getIntrospectionSignedResponseAlgValuesSupported());\n            throw new IllegalArgumentException(\"Unable to use 'none' as introspection signing algorithm\");\n        }\n        return StringUtils.isNotBlank(registeredService.getIntrospectionSignedResponseAlg())\n            && !Strings.CI.equals(registeredService.getIntrospectionSignedResponseAlg(), AlgorithmIdentifiers.NONE);\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(registeredService.getIntrospectionEncryptedResponseAlg())\n            && !discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n            LOGGER.error(\"Service [{}] has defined 'none' for introspection encryption algorithm, \"\n                    + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                    + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                registeredService.getServiceId(), discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported());\n            throw new IllegalArgumentException(\"Unable to use 'none' as introspection encryption algorithm\");\n        }\n        return StringUtils.isNotBlank(registeredService.getIntrospectionEncryptedResponseAlg())\n            && !Strings.CI.equals(registeredService.getIntrospectionEncryptedResponseAlg(), AlgorithmIdentifiers.NONE);\n    }\n\n    @Override\n    public Set<String> getAllowedSigningAlgorithms(final OAuthRegisteredService registeredService) {\n        return this.discoverySettings.getIntrospectionSignedResponseAlgValuesSupported();\n    }\n\n    @Override\n    protected String encryptToken(final OAuthRegisteredService registeredService,\n                                  final String innerJwt) {\n        val jsonWebKey = getJsonWebKeyForEncryption(registeredService);\n        return JsonWebTokenEncryptor.builder()\n            .key(jsonWebKey.getPublicKey())\n            .keyId(jsonWebKey.getKeyId())\n            .algorithm(registeredService.getIntrospectionEncryptedResponseAlg())","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/profile/OidcTokenIntrospectionSigningAndEncryptionService.java#L57-L93","documentation":"The encryption counterpart of shouldSignToken: shouldEncryptToken throws when a registered service sets introspectionEncryptedResponseAlg='none' but discovery metadata does not list 'none' among supported introspection encryption algorithms. CAS treats this mismatch as server/service misconfiguration and refuses to proceed with introspection response encryption.","triggerScenarios":"Triggering token introspection for a service whose introspectionEncryptedResponseAlg is 'none' while cas.authn.oidc.discovery.introspectionEncryptedResponseAlgValuesSupported excludes 'none'.","commonSituations":"Service definitions copied across environments with different discovery encryption settings; expecting 'none' to simply disable encryption without enabling it in discovery; security hardening that removed 'none' from supported values.","solutions":["Add 'none' to cas.authn.oidc.discovery.introspectionEncryptedResponseAlgValuesSupported if unencrypted introspection responses are acceptable.","Otherwise set the service's introspectionEncryptedResponseAlg to a supported algorithm (e.g. RSA-OAEP-256 / A256GCM family).","Remove the introspectionEncryptedResponseAlg setting from the service to fall back to defaults.","Reconcile the service registry with current discovery settings after upgrades."],"exampleFix":"// before (service JSON)\n\"introspectionEncryptedResponseAlg\": \"none\"\n// after\n\"introspectionEncryptedResponseAlg\": \"RSA-OAEP-256\"","handlingStrategy":"validation","validationCode":"String alg = service.getIntrospectionEncryptedResponseAlg();\nList<String> supported = discoverySettings.getIntrospectionEncryptedResponseAlgValuesSupported();\nif (\"none\".equalsIgnoreCase(alg) && !supported.contains(\"none\")) {\n    throw new IllegalStateException(\"'none' not supported for introspection encryption\");\n}","typeGuard":null,"tryCatchPattern":"try { introspectionService.shouldEncryptToken(service, discovery); } catch (IllegalArgumentException e) {\n    LOGGER.error(\"Fix service {} encryption alg\", service.getServiceId(), e);\n}","preventionTips":["Mirror signing/encryption settings changes across environments","Use a registration validator that checks alg values against discovery metadata","After security hardening, audit services still specifying 'none'"],"tags":["oidc","introspection","encryption","misconfiguration","none-alg"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}