{"record":{"id":"87eb62bc51132a63","repo":"spring-projects/spring-security","slug":"oidc-provider-not-configured-87eb62","errorCode":"oidc_provider_not_configured","errorMessage":"An OpenID Connect Authentication Provider has not been configured. Check to ensure you include the dependency 'spring-security-oauth2-jose'.","messagePattern":"An OpenID Connect Authentication Provider has not been configured\\. Check to ensure you include the dependency 'spring-security-oauth2-jose'\\.","errorType":"exception","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParser.java","lineNumber":411,"sourceCode":"\n\t\t@Override\n\t\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\t\tOAuth2LoginAuthenticationToken authorizationCodeAuthentication = (OAuth2LoginAuthenticationToken) authentication;\n\t\t\tif (!authorizationCodeAuthentication.getAuthorizationExchange()\n\t\t\t\t.getAuthorizationRequest()\n\t\t\t\t.getScopes()\n\t\t\t\t.contains(OidcScopes.OPENID)) {\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\t// Section 3.1.2.1 Authentication Request -\n\t\t\t// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest scope\n\t\t\t// REQUIRED. OpenID Connect requests MUST contain the \"openid\" scope\n\t\t\t// value.\n\t\t\tOAuth2Error oauth2Error = new OAuth2Error(\"oidc_provider_not_configured\",\n\t\t\t\t\t\"An OpenID Connect Authentication Provider has not been configured. \"\n\t\t\t\t\t\t\t+ \"Check to ensure you include the dependency 'spring-security-oauth2-jose'.\",\n\t\t\t\t\tnull);\n\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t}\n\n\t\t@Override\n\t\tpublic boolean supports(Class<?> authentication) {\n\t\t\treturn OAuth2LoginAuthenticationToken.class.isAssignableFrom(authentication);\n\t\t}\n\n\t}\n\n\t/**\n\t * Wrapper bean class to provide configuration from applicationContext.\n\t */\n\tprivate static class OAuth2LoginBeanConfig implements ApplicationContextAware {\n\n\t\tprivate ApplicationContext context;\n\n\t\t@Override\n\t\tpublic void setApplicationContext(ApplicationContext context) throws BeansException {","sourceCodeStart":393,"sourceCodeEnd":429,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParser.java#L393-L429","documentation":"Spring Security's OAuth2LoginAuthenticationProvider requires an OpenID Connect authentication provider to handle OIDC (openid scope) logins. When none is configured, authenticate() (OAuth2LoginBeanDefinitionParser.java:411) throws OAuth2AuthenticationException with code 'oidc_provider_not_configured'. This typically means the spring-security-oauth2-jose dependency, which supplies the JwtDecoder/OIDC provider machinery, is absent from the classpath.","triggerScenarios":"A login request with the 'openid' scope reaches OAuth2LoginAuthenticationProvider.authenticate() while the application context has no OIDC provider registered — usually because spring-security-oauth2-jose is missing or OIDC was not configured in <oauth2-login>.","commonSituations":"Developers adding the oauth2-client dependency but forgetting oauth2-jose; using Google/Azure AD (which mandate openid scope) with incomplete dependencies; upgrading Spring Security and dropping a transitive dependency.","solutions":["Add the spring-security-oauth2-jose dependency to your build.","Configure a JwtDecoder or client registration that enables OIDC provider setup in <oauth2-login>.","Remove the 'openid' scope if you intend plain OAuth2 login without OIDC."],"exampleFix":"// before\n<dependency>\n  <groupId>org.springframework.security</groupId>\n  <artifactId>spring-security-oauth2-client</artifactId>\n</dependency>\n// after\n<dependency>\n  <groupId>org.springframework.security</groupId>\n  <artifactId>spring-security-oauth2-client</artifactId>\n</dependency>\n<dependency>\n  <groupId>org.springframework.security</groupId>\n  <artifactId>spring-security-oauth2-jose</artifactId>\n</dependency>","handlingStrategy":"try-catch","validationCode":"Class.forName(\"org.springframework.security.oauth2.jwt.JwtDecoder\");\nassert ctx.getBeanNamesForType(JwtDecoder.class).length > 0 || clientRegistrationUsesOpenIdScopes() == false;","typeGuard":null,"tryCatchPattern":"try { authenticationManager.authenticate(token); } catch (OAuth2AuthenticationException e) { if (\"oidc_provider_not_configured\".equals(e.getError().getErrorCode())) { throw new ConfigurationException(\"Add spring-security-oauth2-jose and configure a JwtDecoder\"); } throw e; }","preventionTips":["Always add spring-security-oauth2-jose alongside spring-security-oauth2-client","Verify the 'openid' scope is only used when OIDC provider machinery is present","Run a startup check that JwtDecoder/OidcUserDetailsService beans resolve when openid scope is configured"],"tags":["spring-security","oauth2","oidc","missing-dependency","authentication"],"backgroundTag":"missing-optional-dependency","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}