{"record":{"id":"f723b2ad29b2bee7","repo":"apereo/cas","slug":"could-not-locate-rsa-json-web-key-from-endpoint","errorCode":null,"errorMessage":"Could not locate RSA JSON web key from endpoint","messagePattern":"Could not locate RSA JSON web key from endpoint","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java","lineNumber":122,"sourceCode":"            throw new IllegalArgumentException(\"Could not locate RSA JSON web key from keystore\");\n        }\n        val key = result.get();\n        if (key.getPublicKey() == null) {\n            throw new IllegalArgumentException(\"Public key located from keystore for key id \" + key.getKeyId() + \" is undefined\");\n        }\n        setSigningKey(key.getPublicKey());\n    }\n\n    private void configureEncryptionParametersForDecoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();\n                val encKeyResult = findRsaJsonWebKey(keys, jsonWebKey -> true);\n\n                if (encKeyResult.isEmpty()) {\n                    throw new IllegalArgumentException(\"Could not locate RSA JSON web key from endpoint\");\n                }\n                val encKey = encKeyResult.get();\n                if (encKey.getPrivateKey() == null) {\n                    throw new IllegalArgumentException(\"Private key located from endpoint for key id \" + encKey.getKeyId() + \" is undefined\");\n                }\n                setEncryptionKey(encKey.getPrivateKey());\n                setContentEncryptionAlgorithmIdentifier(ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);\n                setEncryptionAlgorithm(KeyManagementAlgorithmIdentifiers.RSA_OAEP_256);\n            }\n        });\n    }\n\n    private void configureEncryptionParametersForEncoding() {\n        FunctionUtils.doUnchecked(param -> {\n            if (httpsJkws.isEmpty()) {\n                LOGGER.debug(\"No JWKS endpoint is defined. Configuration of encryption parameters and keys are skipped\");\n            } else {\n                val keys = this.httpsJkws.get().getJsonWebKeys();","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java#L104-L140","documentation":"While preparing decoding (decryption) parameters, a JWKS endpoint is configured, but no RSA JWK could be selected from the keys fetched from that remote endpoint; IllegalArgumentException aborts decode. The input at fault is the remote JWKS content (or its key-id filter), which lacks a usable RSA key for decryption.","triggerScenarios":"Thrown at core/cas-server-core-util-api/src/main/java/org/apereo/cas/util/cipher/JsonWebKeySetStringCipherExecutor.java:122 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Confirm the JWKS endpoint is reachable and returns a valid JWKS document containing RSA keys","Check the configured key id against the kids published by the endpoint","Refresh/redeploy the remote party's keys and verify CAS fetches the latest JWKS"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}