{"record":{"id":"419e94b6414330c6","repo":"spring-projects/spring-security","slug":"an-error-occurred-reading-the-openid-provider-conf","errorCode":null,"errorMessage":"An error occurred reading the OpenID Provider Configuration: ${ex.getMessage()}","messagePattern":"An error occurred reading the OpenID Provider Configuration: (.+?)","errorType":"http","errorClass":"HttpMessageNotReadableException","httpStatus":400,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverter.java","lineNumber":84,"sourceCode":"\t\tthis.jsonMessageConverter = converter;\n\t}\n\n\t@Override\n\tprotected boolean supports(Class<?> clazz) {\n\t\treturn OidcProviderConfiguration.class.isAssignableFrom(clazz);\n\t}\n\n\t@Override\n\t@SuppressWarnings(\"unchecked\")\n\tprotected OidcProviderConfiguration readInternal(Class<? extends OidcProviderConfiguration> clazz,\n\t\t\tHttpInputMessage inputMessage) throws HttpMessageNotReadableException {\n\t\ttry {\n\t\t\tMap<String, Object> providerConfigurationParameters = (Map<String, Object>) this.jsonMessageConverter\n\t\t\t\t.read(STRING_OBJECT_MAP.getType(), null, inputMessage);\n\t\t\treturn this.providerConfigurationConverter.convert(providerConfigurationParameters);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new HttpMessageNotReadableException(\n\t\t\t\t\t\"An error occurred reading the OpenID Provider Configuration: \" + ex.getMessage(), ex,\n\t\t\t\t\tinputMessage);\n\t\t}\n\t}\n\n\t@Override\n\tprotected void writeInternal(OidcProviderConfiguration providerConfiguration, HttpOutputMessage outputMessage)\n\t\t\tthrows HttpMessageNotWritableException {\n\t\ttry {\n\t\t\tMap<String, Object> providerConfigurationResponseParameters = this.providerConfigurationParametersConverter\n\t\t\t\t.convert(providerConfiguration);\n\t\t\tthis.jsonMessageConverter.write(providerConfigurationResponseParameters, STRING_OBJECT_MAP.getType(),\n\t\t\t\t\tMediaType.APPLICATION_JSON, outputMessage);\n\t\t}\n\t\tcatch (Exception ex) {\n\t\t\tthrow new HttpMessageNotWritableException(\n\t\t\t\t\t\"An error occurred writing the OpenID Provider Configuration: \" + ex.getMessage(), ex);\n\t\t}","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverter.java#L66-L102","documentation":"OidcProviderConfigurationHttpMessageConverter.readInternal deserializes a request body into an OidcProviderConfiguration. Any failure reading the JSON or converting the parameter map is wrapped in an HttpMessageNotReadableException with message \"An error occurred reading the OpenID Provider Configuration: <cause message>\". This converter backs the provider configuration endpoint, so in practice this error appears only when the endpoint is invoked in an unusual, non-standard way.","triggerScenarios":"Any consumer sending a request body to the provider configuration endpoint (/.well-known/openid-configuration) via a path that uses this converter's read path with an unparseable or semantically invalid JSON body.","commonSituations":"Tests or tools POSTing bodies to a discovery endpoint that is normally GET-only; custom request matchers reusing this converter for a new endpoint; sending JSON that violates OidcProviderConfiguration's expected shape; content-type mismatches.","solutions":["Call the discovery endpoint with GET and no request body, as the OIDC Discovery spec requires.","Inspect the nested cause message for the exact JSON parse or conversion failure and correct the body.","Ensure Content-Type: application/json and a JSON-object body matching OidcProviderConfiguration fields if a body is genuinely required by a custom endpoint.","If building a custom endpoint on this converter, register a custom Converter<Map<String,Object>, OidcProviderConfiguration> that accepts your payload."],"exampleFix":"// before\ncurl -X POST https://server/.well-known/openid-configuration -d '{\"issuer\": 123}'\n\n// after\ncurl https://server/.well-known/openid-configuration","handlingStrategy":"validation","validationCode":"boolean isDiscoveryRequest(HttpServletRequest request) {\n    return \"GET\".equalsIgnoreCase(request.getMethod())\n        && (request.getContentLengthLong() <= 0);\n}","typeGuard":"boolean isProviderConfigurationBody(Object body) {\n    return body instanceof Map<?, ?> m && m.get(\"issuer\") instanceof String;\n}","tryCatchPattern":"try {\n    OidcProviderConfiguration cfg = converter.read(OidcProviderConfiguration.class, inputMessage);\n} catch (HttpMessageNotReadableException ex) {\n    log.warn(\"Invalid provider configuration request: {}\", ex.getCause() != null ? ex.getCause().getMessage() : ex.getMessage());\n    response.sendError(HttpStatus.BAD_REQUEST.value());\n}","preventionTips":["Access the discovery endpoint via GET with no body.","Do not wire this read converter into endpoints expecting arbitrary POST bodies.","Match the exact field types OidcProviderConfiguration expects when constructing test payloads."],"tags":["http","json","deserialization","oidc","provider-configuration"],"backgroundTag":"json-unmarshal-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}