{"record":{"id":"05af274ccf0fc66a","repo":"spring-projects/spring-security","slug":"authorizationgranttype-s-does-not-match-the-pre","errorCode":null,"errorMessage":"AuthorizationGrantType: %s does not match the pre-defined constant %s and won't match a valid OAuth2AuthorizedClientProvider","messagePattern":"AuthorizationGrantType: (.+?) does not match the pre-defined constant (.+?) and won't match a valid OAuth2AuthorizedClientProvider","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java","lineNumber":715,"sourceCode":"\t\t\tAssert.hasText(this.authorizationUri, \"authorizationUri cannot be empty\");\n\t\t\tAssert.hasText(this.tokenUri, \"tokenUri cannot be empty\");\n\t\t}\n\n\t\tprivate void validateClientCredentialsGrantType() {\n\t\t\tAssert.notNull(this.authorizationGrantType, \"authorizationGrantType cannot be null\");\n\t\t\tAssert.isTrue(AuthorizationGrantType.CLIENT_CREDENTIALS.equals(this.authorizationGrantType),\n\t\t\t\t\t() -> \"authorizationGrantType must be \" + AuthorizationGrantType.CLIENT_CREDENTIALS.getValue());\n\t\t\tAssert.hasText(this.registrationId, \"registrationId cannot be empty\");\n\t\t\tAssert.hasText(this.clientId, \"clientId cannot be empty\");\n\t\t\tAssert.hasText(this.tokenUri, \"tokenUri cannot be empty\");\n\t\t}\n\n\t\tprivate void validateAuthorizationGrantTypes() {\n\t\t\tAssert.notNull(this.authorizationGrantType, \"authorizationGrantType cannot be null\");\n\t\t\tfor (AuthorizationGrantType authorizationGrantType : AUTHORIZATION_GRANT_TYPES) {\n\t\t\t\tif (authorizationGrantType.getValue().equalsIgnoreCase(this.authorizationGrantType.getValue())\n\t\t\t\t\t\t&& !authorizationGrantType.equals(this.authorizationGrantType)) {\n\t\t\t\t\tlogger.warn(LogMessage.format(\n\t\t\t\t\t\t\t\"AuthorizationGrantType: %s does not match the pre-defined constant %s and won't match a valid OAuth2AuthorizedClientProvider\",\n\t\t\t\t\t\t\tthis.authorizationGrantType, authorizationGrantType));\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (!AuthorizationGrantType.AUTHORIZATION_CODE.equals(this.authorizationGrantType)\n\t\t\t\t\t&& this.clientSettings.isRequireProofKey()) {\n\t\t\t\tthis.clientSettings = ClientSettings.builder().requireProofKey(false).build();\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateScopes() {\n\t\t\tif (this.scopes == null) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tfor (String scope : this.scopes) {\n\t\t\t\tAssert.isTrue(validateScope(scope), \"scope \\\"\" + scope + \"\\\" contains invalid characters\");\n\t\t\t}\n\t\t}","sourceCodeStart":697,"sourceCodeEnd":733,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java#L697-L733","documentation":"ClientRegistration.Builder.build() warns when the supplied AuthorizationGrantType has the same value as one of the pre-defined constants (AUTHORIZATION_CODE, CLIENT_CREDENTIALS, etc.) but is a different instance. Such a non-canonical instance will not match by reference/equality in OAuth2AuthorizedClientProvider selection, so authorized client resolution silently fails.","triggerScenarios":"Calling ClientRegistration.withRegistrationId(...).authorizationGrantType(new AuthorizationGrantType(\"authorization_code\")) or reading a grant type string and constructing a new instance instead of using AuthorizationGrantType.AUTHORIZATION_CODE.","commonSituations":"Deserializing client registrations from config/DB where the grant type string is mapped to a fresh AuthorizationGrantType object; custom grant types that collide with built-in values case-insensitively.","solutions":["Use the predefined constants: AuthorizationGrantType.AUTHORIZATION_CODE, CLIENT_CREDENTIALS, PASSWORD, JWT_BEARER, DEVICE_CODE instead of new AuthorizationGrantType(...)","Normalize loaded grant type values to the constant via a mapping/lookup in your ClientRegistration repository","If a truly custom grant type, choose a value that does not collide with the built-in ones"],"exampleFix":"// before\n.authorizationGrantType(new AuthorizationGrantType(\"authorization_code\"))\n// after\n.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)","handlingStrategy":"validation","validationCode":"String value = grantTypeValue.trim();\nAuthorizationGrantType actual = Stream.of(\n        AuthorizationGrantType.AUTHORIZATION_CODE, AuthorizationGrantType.CLIENT_CREDENTIALS,\n        AuthorizationGrantType.PASSWORD, AuthorizationGrantType.JWT_BEARER,\n        AuthorizationGrantType.DEVICE_CODE)\n    .filter(g -> g.getValue().equalsIgnoreCase(value))\n    .findFirst().orElse(new AuthorizationGrantType(value));\n","typeGuard":"AuthorizationGrantType canonicalGrantType(String value) {\n    if (\"authorization_code\".equalsIgnoreCase(value)) return AuthorizationGrantType.AUTHORIZATION_CODE;\n    if (\"client_credentials\".equalsIgnoreCase(value)) return AuthorizationGrantType.CLIENT_CREDENTIALS;\n    return new AuthorizationGrantType(value);\n}","tryCatchPattern":null,"preventionTips":["Always use AuthorizationGrantType predefined constants in code and mappers","Normalize grant-type strings from config/DB through a lookup table","Add an integration test asserting OAuth2AuthorizedClientProvider resolution works for each registered client"],"tags":["oauth2-client","client-registration","grant-type","spring-security"],"backgroundTag":"invalid-enum-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}