{"record":{"id":"5b4c641b98d1074b","repo":"spring-projects/spring-security","slug":"the-issuer-identifier-issuer-cannot-be-set-wh","errorCode":null,"errorMessage":"The issuer identifier (${issuer}) cannot be set when isMultipleIssuersAllowed() is true.","messagePattern":"The issuer identifier \\((.+?)\\) cannot be set when isMultipleIssuersAllowed\\(\\) is true\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/settings/AuthorizationServerSettings.java","lineNumber":411,"sourceCode":"\t\t/**\n\t\t * Sets the OpenID Connect 1.0 Logout endpoint.\n\t\t * @param oidcLogoutEndpoint the OpenID Connect 1.0 Logout endpoint\n\t\t * @return the {@link Builder} for further configuration\n\t\t */\n\t\tpublic Builder oidcLogoutEndpoint(String oidcLogoutEndpoint) {\n\t\t\treturn setting(ConfigurationSettingNames.AuthorizationServer.OIDC_LOGOUT_ENDPOINT, oidcLogoutEndpoint);\n\t\t}\n\n\t\t/**\n\t\t * Builds the {@link AuthorizationServerSettings}.\n\t\t * @return the {@link AuthorizationServerSettings}\n\t\t */\n\t\t@Override\n\t\tpublic AuthorizationServerSettings build() {\n\t\t\tAuthorizationServerSettings authorizationServerSettings = new AuthorizationServerSettings(getSettings());\n\t\t\tif (authorizationServerSettings.getIssuer() != null\n\t\t\t\t\t&& authorizationServerSettings.isMultipleIssuersAllowed()) {\n\t\t\t\tthrow new IllegalArgumentException(\"The issuer identifier (\" + authorizationServerSettings.getIssuer()\n\t\t\t\t\t\t+ \") cannot be set when isMultipleIssuersAllowed() is true.\");\n\t\t\t}\n\t\t\treturn authorizationServerSettings;\n\t\t}\n\n\t}\n\n}\n","sourceCodeStart":393,"sourceCodeEnd":420,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/settings/AuthorizationServerSettings.java#L393-L420","documentation":"This IllegalArgumentException from AuthorizationServerSettings.Builder.build prevents constructing settings that both define a fixed issuer and enable multiple issuers. A fixed issuer is incompatible with multi-issuer mode, where the issuer must be derived per-request/tenant. The library rejects the conflicting configuration eagerly at startup.","triggerScenarios":"Calling AuthorizationServerSettings.builder().issuer(\"https://...\").multipleIssuersAllowed(true).build() — any combination where getIssuer() != null and isMultipleIssuersAllowed() is true.","commonSituations":"Upgrading to multi-tenant issuer support while keeping an existing issuer(...) setting; enabling multipleIssuersAllowed(true) via a property while a default issuer is configured elsewhere; copying single-tenant config into a multi-tenant deployment.","solutions":["Remove the .issuer(...) call when multipleIssuersAllowed(true) is set, letting the issuer be resolved per request","Or set multipleIssuersAllowed(false) if a single fixed issuer is intended","Check external configuration (properties) for a conflicting issuer value"],"exampleFix":"// before\nAuthorizationServerSettings.builder().issuer(\"https://example.com\").multipleIssuersAllowed(true).build();\n// after\nAuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();","handlingStrategy":"validation","validationCode":"// Validate builder inputs before build()\nboolean conflicting = issuer != null && multipleIssuersAllowed;\nif (conflicting) throw new IllegalStateException(\"issuer set while multipleIssuersAllowed=true\");","typeGuard":null,"tryCatchPattern":"try {\n    settings = AuthorizationServerSettings.builder()...\n        .build();\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"isMultipleIssuersAllowed\")) {\n        settings = AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();\n    }\n}","preventionTips":["Choose one mode: fixed issuer OR multiple issuers, never both","Audit externalized configuration (properties/env) for an issuer value when enabling multi-tenancy","Add an integration test that builds AuthorizationServerSettings at startup"],"tags":["configuration","oauth2","issuer","multi-tenant"],"backgroundTag":"conflicting-config-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}