quarkusio/quarkus · error · ConfigurationException

Unsupported signature algorithm

Error message

Unsupported signature algorithm

What it means

The configured JWT signature algorithm string could not be parsed into a known JOSE SignatureAlgorithm. Quarkus validates quarkus.oidc-client.credentials.jwt.signature-algorithm at startup and rejects unknown/unsupported values.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:584

        if (key instanceof SecretKey) {
            return jwtSignatureBuilder.sign((SecretKey) key);
        } else {
            return jwtSignatureBuilder.sign((PrivateKey) key);
        }
    }

    @SuppressWarnings({ "unchecked", "rawtypes" })
    private static Map<String, Object> additionalClaims(Map<String, String> claims) {
        return (Map) claims;
    }

    private static SignatureAlgorithm getSignatureAlgorithm(Credentials credentials, SignatureAlgorithm defaultAlgorithm) {
        if (credentials.jwt().signatureAlgorithm().isPresent()) {
            try {
                return SignatureAlgorithm.fromAlgorithm(credentials.jwt().signatureAlgorithm().get());
            } catch (Exception ex) {
                throw new ConfigurationException("Unsupported signature algorithm");
            }
        } else {
            return defaultAlgorithm;
        }
    }

    public static void verifyConfigurationId(String defaultId, String configKey, Optional<String> configId) {
        if (configKey.equals(defaultId)) {
            throw new ConfigurationException("configuration id '" + configKey + "' duplicates the default configuration id");
        }
        if (configId.isPresent() && !configKey.equals(configId.get())) {
            throw new ConfigurationException("Configuration has 2 different id values: '"
                    + configKey + "' and '" + configId.get() + "'");
        }

    }

    public static String initClientSecretBasicAuth(OidcClientCommonConfig oidcConfig, String clientSecret) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set the property to a supported value: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, PS512 (as supported by the underlying JOSE library)
2. Remove the property to use the default algorithm chosen for the configured key type
3. Check the Quarkus version's supported SignatureAlgorithm enum if an algorithm is rejected
4. Trim whitespace/quotes around the configured value

Example fix

// before
quarkus.oidc-client.credentials.jwt.signature-algorithm=ES256K
// after
quarkus.oidc-client.credentials.jwt.signature-algorithm=ES256

Set<String> supported = Set.of("HS256","HS384","HS512","RS256","RS384","RS512","ES256","ES384","ES512","PS256","PS384","PS512");
String alg = ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.signature-algorithm", String.class).orElse("");
if (!alg.isEmpty() && !supported.contains(alg.trim())) throw new IllegalStateException("Unsupported signature algorithm: " + alg);

When it happens

Trigger: credentials.jwt.signature-algorithm set to a value not recognized by SignatureAlgorithm.fromAlgorithm — misspelling, wrong casing, or an algorithm (e.g. PS512, EdDSA in older JOSE4j) the underlying implementation does not support.

Common situations: Copying an algorithm name from provider docs using non-standard spelling ('HS256 ' with whitespace, 'ES256K'); upgrading/downgrading Quarkus changes the supported algorithm set; typos like 'HS245'.

Related errors

• %s OidcClient can not complete the %s grant request because
• %s OidcClient wants to use JWT bearer grant assertion but ha
• When using a key store, the `quarkus.oidc-client.credentials
• Key is null
• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0d8e322a02b7a9ae. Report an issue: GitHub.