keycloak/keycloak · error · IllegalArgumentException

No provider for alg

Error message

No provider for alg 

What it means

Thrown by JWE.getProcessedJWE (the decode path) when algorithmProvider is null. Unlike the encode path (error 246), this message is a static literal 'No provider for alg ' with a trailing space and does NOT interpolate the offending algorithm value — so it does not tell you which alg failed. The provider is null because header.getAlgorithm() did not resolve via JWERegistry.getAlgProvider, or the caller of verifyAndDecodeJwe(token, algProvider, encProvider) passed null.

Source

Thrown at core/src/main/java/org/keycloak/jose/jwe/JWE.java:188

    private void setupJWEHeader(String jweStr) throws IllegalStateException {
        String[] parts = jweStr.split("\\.");
        if (parts.length != 5) {
            throw new IllegalStateException("Not a JWE String");
        }

        this.base64Header = parts[0];
        this.base64Cek = parts[1];
        this.initializationVector = Base64Url.decode(parts[2]);
        this.encryptedContent = Base64Url.decode(parts[3]);
        this.authenticationTag = Base64Url.decode(parts[4]);

        this.header = (JWEHeader) getHeader();
    }

    private JWE getProcessedJWE(JWEAlgorithmProvider algorithmProvider, JWEEncryptionProvider encryptionProvider) throws Exception {
        if (algorithmProvider == null) {
            throw new IllegalArgumentException("No provider for alg ");
        }

        if (encryptionProvider == null) {
            throw new IllegalArgumentException("No provider for enc ");
        }

        keyStorage.setEncryptionProvider(encryptionProvider);

        byte[] decodedCek = algorithmProvider.decodeCek(Base64Url.decode(base64Cek), keyStorage.getDecryptionKey(), this.header, encryptionProvider);
        keyStorage.setCEKBytes(decodedCek);

        encryptionProvider.verifyAndDecodeJwe(this);

        return this;
    }

    public JWE verifyAndDecodeJwe(String jweStr) throws JWEException {
        try {

View on GitHub (pinned to 66c7e15a37)

Solutions

1. Inspect jwe.getHeader().getAlgorithm() (or the raw token's first segment) to identify the alg value that failed to resolve.
2. Ensure the crypto provider that registers the required algorithm is active (e.g. FIPS/bcfips for RSA-OAEP-256).
3. If using the explicit-provider overload, pass a non-null algorithmProvider.
4. Note the message bug (missing alg name) and rely on header inspection rather than the exception text.

Example fix

// before
JWE jwe = new JWE(token);
jwe.verifyAndDecodeJwe(); // alg unknown -> generic message

// after
JWE jwe = new JWE(token);
String alg = jwe.getHeader().getAlgorithm();
JWEAlgorithmProvider algProvider = JWERegistry.getAlgProvider(alg);
if (algProvider == null) {
    throw new UnsupportedAlgorithmException("Unsupported JWE alg: " + alg);
}
jwe.verifyAndDecodeJwe(token, algProvider, encProvider);

public static void assertAlgResolvable(JWE jwe) {
    String alg = jwe.getHeader().getAlgorithm();
    if (JWERegistry.getAlgProvider(alg) == null) {
        throw new UnsupportedAlgorithmException("No JWE alg provider for: " + alg);
    }
}

try {
    jwe.verifyAndDecodeJwe();
} catch (JWEException e) {
    Throwable c = e.getCause();
    if (c instanceof IllegalArgumentException && c.getMessage().startsWith("No provider for alg")) {
        // note: the library message does NOT include the alg value
        String alg = jwe.getHeader().getAlgorithm();
        throw new UnsupportedAlgorithmException("Unsupported JWE alg on decode: " + alg, c);
    }
    throw e;
}

When it happens

Trigger: Decoding a JWE whose header 'alg' is not 'dir' and not registered with the crypto provider; or calling the explicit-provider verifyAndDecodeJwe overload with a null algorithmProvider.

Common situations: Receiving a JWE encrypted with an algorithm the runtime does not support (e.g. an ECDH-ES variant on a build without the corresponding crypto provider), or downgrading a Keycloak build that dropped an algorithm.

Related errors

• No provider for enc
• No provider for alg '{algorithm}'
• No provider for enc '{encryptionAlgorithm}'
• Signature validations failed
• Header must be set

AI-assisted analysis of keycloak/keycloak@66c7e15a37 (2026-08-14). Data as JSON: /api/errors/23e96c34d7f071fe. Report an issue: GitHub.