{"record":{"id":"b6c366aec505cfb2","repo":"apereo/cas","slug":"unable-to-use-none-as-id-token-signing-algorithm","errorCode":null,"errorMessage":"Unable to use 'none' as ID token signing algorithm","messagePattern":"Unable to use 'none' as ID token signing algorithm","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java","lineNumber":63,"sourceCode":"            return super.getJsonWebKeySigningAlgorithm(registeredService, jsonWebKey);\n        }\n        return svc.getIdTokenSigningAlg();\n    }\n\n    @Override\n    public boolean shouldSignToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n            if (!service.isSignIdToken()) {\n                LOGGER.trace(\"Service [{}] does not require ID token to be signed\", registeredService.getServiceId());\n                return false;\n            }\n            if (AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenSigningAlg())) {\n                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                    LOGGER.error(\"Service [{}] has defined 'none' for ID token signing algorithm, \"\n                            + \"yet CAS is configured to support the following signing algorithms: [{}]. \"\n                            + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                        registeredService.getServiceId(), discoverySettings.getIdTokenSigningAlgValuesSupported());\n                    throw new IllegalArgumentException(\"Unable to use 'none' as ID token signing algorithm\");\n                }\n                LOGGER.error(\"Service [{}] has defined 'none' for ID token signing algorithm\", registeredService.getServiceId());\n                return false;\n            }\n            return true;\n        }\n        return false;\n    }\n\n    @Override\n    public boolean shouldEncryptToken(final OAuthRegisteredService registeredService) {\n        if (registeredService instanceof final OidcRegisteredService service) {\n            if (service.isEncryptIdToken() && AlgorithmIdentifiers.NONE.equalsIgnoreCase(service.getIdTokenEncryptionAlg())) {\n                if (!discoverySettings.getIdTokenSigningAlgValuesSupported().contains(AlgorithmIdentifiers.NONE)) {\n                    LOGGER.error(\"Service [{}] has defined 'none' for ID token encryption algorithm, \"\n                            + \"yet CAS is configured to support the following encryption algorithms: [{}]. \"\n                            + \"This is quite likely due to misconfiguration of the CAS server or the service definition\",\n                        registeredService.getServiceId(), discoverySettings.getIdTokenEncryptionAlgValuesSupported());","sourceCodeStart":45,"sourceCodeEnd":81,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-oidc-core-api/src/main/java/org/apereo/cas/oidc/token/OidcIdTokenSigningAndEncryptionService.java#L45-L81","documentation":"OidcIdTokenSigningAndEncryptionService.shouldSignToken throws this when a registered service sets its ID token signing algorithm to 'none' but the server's discovery settings do not allow 'none' among supported ID token signing algorithms. CAS refuses the combination as a likely misconfiguration. Notably, if 'none' IS supported, it logs an error and returns false (no signing) instead of throwing.","triggerScenarios":"registeredService.getIdTokenSigningAlg() equals 'none' and discoverySettings.getIdTokenSigningAlgValuesSupported() lacks 'none'; evaluated when issuing an ID token for that service.","commonSituations":"Admin chose 'none' (id_token via code flow allows it per spec) but the CAS discovery config only lists RS256/ES256 etc.; service definitions imported from an environment where 'none' was enabled.","solutions":["Add 'none' to cas.authn.oidc.core.id-token-signing-alg-values-supported if unsigned ID tokens are acceptable for this flow","Or set the service's id-token signing algorithm to a supported value (e.g. RS256)","Check the advertised id_token_signing_alg_values_supported in discovery metadata"],"exampleFix":"// before (service definition)\n\"idTokenSigningAlg\": \"none\"\n// after\ncas.authn.oidc.core.id-token-signing-alg-values-supported=RS256,ES256,none\n// or\n\"idTokenSigningAlg\": \"RS256\"","handlingStrategy":"validation","validationCode":"var supported = discoveryMetadata.getIdTokenSigningAlgValuesSupported();\nif (\"none\".equalsIgnoreCase(service.getIdTokenSigningAlg()) && !supported.contains(\"none\")) {\n    throw new IllegalStateException(\"Service \" + service.getServiceId() + \" requests 'none' ID token signing but server supports \" + supported);\n}","typeGuard":null,"tryCatchPattern":"try { idTokenService.shouldSignToken(service, discoverySettings); } catch (IllegalArgumentException e) { log.error(\"ID token signing alg misconfigured for {}: {}\", service.getClientId(), e.getMessage()); }","preventionTips":["Align service id-token signing alg with id_token_signing_alg_values_supported in discovery metadata","Validate service definitions against server config on deploy","Only allow 'none' for code-flow clients if your security policy permits unsigned ID tokens"],"tags":["oidc","configuration","signing","id-token"],"backgroundTag":"invalid-config-value","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}