{"record":{"id":"a0bf63b85bb9cdbc","repo":"spring-projects/spring-security","slug":"missing-signature-verifier","errorCode":"missing_signature_verifier","errorMessage":"Failed to find a Signature Verifier for Client Registration: '{}'. Check to ensure you have configured the JwkSet URI.","messagePattern":"Failed to find a Signature Verifier for Client Registration: '(.+?)'\\. Check to ensure you have configured the JwkSet URI\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java","lineNumber":78,"sourceCode":"\tprivate JwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory;\n\n\t/**\n\t * Construct an {@link OidcBackChannelLogoutAuthenticationProvider}.\n\t */\n\tOidcBackChannelLogoutAuthenticationProvider() {\n\t\tJwtTypeValidator type = new JwtTypeValidator(\"JWT\", \"logout+jwt\");\n\t\ttype.setAllowEmpty(true);\n\t\tFunction<ClientRegistration, OAuth2TokenValidator<Jwt>> jwtValidator = (clientRegistration) -> JwtValidators\n\t\t\t.createDefaultWithValidators(type, new OidcBackChannelLogoutTokenValidator(clientRegistration));\n\t\tthis.logoutTokenDecoderFactory = (clientRegistration) -> {\n\t\t\tString jwkSetUri = clientRegistration.getProviderDetails().getJwkSetUri();\n\t\t\tif (!StringUtils.hasText(jwkSetUri)) {\n\t\t\t\tOAuth2Error oauth2Error = new OAuth2Error(\"missing_signature_verifier\",\n\t\t\t\t\t\t\"Failed to find a Signature Verifier for Client Registration: '\"\n\t\t\t\t\t\t\t\t+ clientRegistration.getRegistrationId()\n\t\t\t\t\t\t\t\t+ \"'. Check to ensure you have configured the JwkSet URI.\",\n\t\t\t\t\t\tnull);\n\t\t\t\tthrow new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());\n\t\t\t}\n\t\t\tNimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();\n\t\t\tdecoder.setJwtValidator(jwtValidator.apply(clientRegistration));\n\t\t\tdecoder.setClaimSetConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverter());\n\t\t\treturn decoder;\n\t\t};\n\t}\n\n\t/**\n\t * {@inheritDoc}\n\t */\n\t@Override\n\tpublic Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tif (!(authentication instanceof OidcLogoutAuthenticationToken token)) {\n\t\t\treturn null;\n\t\t}\n\t\tString logoutToken = token.getLogoutToken();\n\t\tClientRegistration registration = token.getClientRegistration();","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java#L60-L96","documentation":"When validating an OpenID Connect back-channel logout token, OidcBackChannelLogoutAuthenticationProvider builds a JwtDecoder per ClientRegistration; if the registration has no jwkSetUri configured, no SignatureVerifier/JwkSetUriJwtDecoderBuilder can be created, so this IllegalStateException fires. It means the client registration used for the logout request lacks the provider's JWK Set URI, making signature verification of the logout+jwt token impossible and the logout unverifiable.","triggerScenarios":"Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java:78 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set jwkSetUri on the ClientRegistration (e.g. via issuer-uri discovery or explicit .jwkSetUri(...))","Confirm the OIDC provider publishes its JWK Set and the URI is reachable","Verify the clientConfigurationMetadata/back-channel configuration matches the registration used at runtime"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}