{"record":{"id":"b2b44e6ad0364154","repo":"apereo/cas","slug":"private-key-located-from-endpoint-for-key-id-is-u","errorCode":null,"errorMessage":"Private key located from endpoint for key id  is undefined","messagePattern":"Private key located from endpoint for key id  is undefined","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java","lineNumber":126,"sourceCode":"            throw new IllegalArgumentException(\"Public key located from keystore for key id \" + key.getKeyId() + \" is undefined\");\n        }\n        setSigningKey(key.getPublicKey());\n    }\n\n    private void configureEncryptionParametersForDecoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();\n                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);\n\n                if (encKeyResult.isEmpty()) {\n                    throw new IllegalArgumentException(\"Could not locate RSA JSON web key from endpoint\");\n                }\n                val encKey = encKeyResult.get();\n                if (encKey.getPrivateKey() == null) {\n                    throw new IllegalArgumentException(\"Private key located from endpoint for key id \" + encKey.getKeyId() + \" is undefined\");\n                }\n                setEncryptionKey(encKey.getPrivateKey());\n                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);\n                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);\n            }\n        });\n    }\n\n    private void configureEncryptionParametersForEncoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();\n                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);\n\n                if (encKeyResult.isEmpty()) {\n                    throw new IllegalArgumentException(\"Could not locate RSA JSON web key from endpoint\");","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java#L108-L144","documentation":"The RSA JWK selected from the remote JWKS endpoint for decryption has no private key component, so ciphertext cannot be decrypted; IllegalArgumentException aborts decode configuration. The input at fault is the endpoint-published JWK with the given key id — endpoints typically publish public keys only, which suffices for encoding but not decoding.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:126 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the private key is held by the party that must decrypt; fetch the JWKS from a source that publishes the private JWK","Split encode/decode key configuration so decoding uses the local keystore containing the private key","Regenerate a key pair and distribute keys appropriately (public to endpoint, private to decryptor)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}