{"record":{"id":"382db819d97f5159","repo":"spring-projects/spring-security","slug":"invalid-client-registration-fieldname-382db8","errorCode":null,"errorMessage":"Invalid Client Registration: + fieldName","messagePattern":"Invalid Client Registration: \\+ fieldName","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java","lineNumber":405,"sourceCode":"\n\t\tif (\"none\".equals(authenticationSigningAlgorithm)) {\n\t\t\treturn false;\n\t\t}\n\n\t\tif (ClientAuthenticationMethod.PRIVATE_KEY_JWT.getValue().equals(authenticationMethod)) {\n\t\t\treturn clientRegistration.getJwkSetUrl() != null && (!StringUtils.hasText(authenticationSigningAlgorithm)\n\t\t\t\t\t|| SignatureAlgorithm.from(authenticationSigningAlgorithm) != null);\n\t\t}\n\t\telse {\n\t\t\t// client_secret_jwt\n\t\t\treturn !StringUtils.hasText(authenticationSigningAlgorithm)\n\t\t\t\t\t|| MacAlgorithm.from(authenticationSigningAlgorithm) != null;\n\t\t}\n\t}\n\n\tprivate static void throwInvalidClientRegistration(String errorCode, String fieldName) {\n\t\tOAuth2Error error = new OAuth2Error(errorCode, \"Invalid Client Registration: \" + fieldName, ERROR_URI);\n\t\tthrow new OAuth2AuthenticationException(error);\n\t}\n\n}\n","sourceCodeStart":387,"sourceCodeEnd":409,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java#L387-L409","documentation":"Generic validation failure for an OIDC dynamic client registration request. throwInvalidClientRegistration is the helper registerClient uses to reject any metadata field that violates the spec, embedding the failing field name in the message and an OAuth2 error code (usually invalid_client_metadata or invalid_redirect_uri).","triggerScenarios":"A POST /connect/register request whose metadata fails static validation in OidcClientRegistrationAuthenticationProvider.registerClient — e.g. client_name missing/empty where required, unsupported token_endpoint_auth_method, invalid jwks/jwks_uri combination, or a disallowed grant_type.","commonSituations":"Clients sending registration JSON with a null or malformed field, an authentication method the server doesn't accept, or both jwks and jwks_uri supplied; also common after spec updates tighten validation in newer Spring Authorization Server versions.","solutions":["Read the fieldName in the message and correct that exact property in the registration metadata JSON","Ensure redirect_uris, if present, are absolute HTTPS/HTTP URIs and grant_types/response_types are spec-valid strings","Check which error code accompanies the message (invalid_client_metadata vs invalid_redirect_uri) to target metadata vs redirect validation","If registering programmatically, validate metadata against RegisteredClient/ClientSettings conventions before calling the endpoint"],"exampleFix":"// before\n{\n  \"redirect_uris\": [\"http://\"],\n  \"token_endpoint_auth_method\": \"unknown_method\"\n}\n// after\n{\n  \"redirect_uris\": [\"https://client.example.org/callback\"],\n  \"token_endpoint_auth_method\": \"client_secret_basic\"\n}","handlingStrategy":"validation","validationCode":"Map<String,Object> metadata = registrationJson;\nif (metadata.get(\"client_name\") == null || metadata.get(\"client_name\").toString().isBlank()) {\n    throw new IllegalArgumentException(\"client_name is required\");\n}\nString authMethod = (String) metadata.getOrDefault(\"token_endpoint_auth_method\", \"client_secret_basic\");\nSet.of(\"none\",\"client_secret_basic\",\"client_secret_post\",\"client_secret_jwt\",\"private_key_jwt\")\n    .contains(authMethod); // else fix before submitting","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate registration metadata against the OIDC Dynamic Client Registration spec before POSTing","Send only one of jwks or jwks_uri, never both","Use well-known token_endpoint_auth_method values","Pin and read release notes of Spring Authorization Server when upgrading, as validation strictness changes"],"tags":["oauth2","oidc","client-registration","validation","spring-authorization-server"],"backgroundTag":"schema-validation-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}