{"record":{"id":"c41d614bbd9f3385","repo":"spring-projects/spring-security","slug":"server-error-c41d61","errorCode":"server_error","errorMessage":"The token generator failed to generate the registration access token.","messagePattern":"The token generator failed to generate the registration access token\\.","errorType":"error_code","errorClass":"OAuth2AuthenticationException","httpStatus":500,"severity":"error","filePath":"oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java","lineNumber":334,"sourceCode":"\t\t\t.add(OidcClientConfigurationAuthenticationProvider.DEFAULT_CLIENT_CONFIGURATION_AUTHORIZED_SCOPE);\n\t\tauthorizedScopes = Collections.unmodifiableSet(authorizedScopes);\n\n\t\t// @formatter:off\n\t\tOAuth2TokenContext tokenContext = DefaultOAuth2TokenContext.builder()\n\t\t\t\t.registeredClient(registeredClient)\n\t\t\t\t.principal(clientPrincipal)\n\t\t\t\t.authorizationServerContext(AuthorizationServerContextHolder.getContext())\n\t\t\t\t.authorizedScopes(authorizedScopes)\n\t\t\t\t.tokenType(OAuth2TokenType.ACCESS_TOKEN)\n\t\t\t\t.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)\n\t\t\t\t.build();\n\t\t// @formatter:on\n\n\t\tOAuth2Token registrationAccessToken = this.tokenGenerator.generate(tokenContext);\n\t\tif (registrationAccessToken == null) {\n\t\t\tOAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,\n\t\t\t\t\t\"The token generator failed to generate the registration access token.\", ERROR_URI);\n\t\t\tthrow new OAuth2AuthenticationException(error);\n\t\t}\n\n\t\tif (this.logger.isTraceEnabled()) {\n\t\t\tthis.logger.trace(\"Generated registration access token\");\n\t\t}\n\n\t\t// @formatter:off\n\t\tOAuth2Authorization.Builder authorizationBuilder = OAuth2Authorization.withRegisteredClient(registeredClient)\n\t\t\t\t.principalName(registeredClient.getClientId())\n\t\t\t\t.authorizationGrantType(AuthorizationGrantType.CLIENT_CREDENTIALS)\n\t\t\t\t.authorizedScopes(authorizedScopes);\n\t\t// @formatter:on\n\n\t\tOidcAuthenticationProviderUtils.accessToken(authorizationBuilder, registrationAccessToken, tokenContext);\n\n\t\tOAuth2Authorization authorization = authorizationBuilder.build();\n\n\t\tthis.authorizationService.save(authorization);","sourceCodeStart":316,"sourceCodeEnd":352,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java#L316-L352","documentation":"This error is thrown by OidcClientRegistrationAuthenticationProvider.registerAccessToken when the configured TokenGenerator returns null instead of an OAuth2Token for the registration access token of a dynamically registered client. It signals a server-side configuration defect: the OAuth2TokenGenerator bean cannot handle the token context (typically an access token with no matching TokenProvider).","triggerScenarios":"A client sends a valid OIDC dynamic client registration request (POST /connect/register) and registerAccessToken calls tokenGenerator.generate(tokenContext), which returns null because the authorization server's OAuth2TokenGenerator is unconfigured, set to OAuth2AccessTokenGenerator without the right encoder, or the token settings on the registration request are unsupported.","commonSituations":"Spring Authorization Server deployments where the OAuth2TokenGenerator bean was customized (e.g. replaced with a JwtGenerator without a JwtEncoder, or an OAuth2AccessTokenGenerator without an OAuth2TokenCustomizer mismatch) or security config upgraded and the default generator chain no longer resolves an access-token generator.","solutions":["Check the OAuth2TokenGenerator bean wired into OAuth2AuthorizationServerConfigurer/authorizationServer(): ensure it composes a generator able to produce access tokens (e.g. new DelegatingOAuth2TokenGenerator(new JwtGenerator(jwtEncoder), new OAuth2AccessTokenGenerator()))","Verify JwtGenerator is constructed with a functioning JwtEncoder and matching OAuth2TokenCustomizer; a misconfigured encoder causes the generator chain to yield null","Confirm the RegisteredClient's TokenSettings for the registration access token don't select a token format (e.g. reference/reference-only) for which no TokenProvider is registered","Enable trace logging on the provider and step into tokenGenerator.generate to see which generator in the chain accepted/rejected the context"],"exampleFix":"// before\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator() {\n    return new OAuth2AccessTokenGenerator(); // cannot satisfy contexts requiring JWTs\n}\n// after\n@Bean\nOAuth2TokenGenerator<?> tokenGenerator(JwtEncoder jwtEncoder) {\n    JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);\n    return new DelegatingOAuth2TokenGenerator(jwtGenerator, new OAuth2AccessTokenGenerator());\n}","handlingStrategy":"try-catch","validationCode":"OAuth2TokenGenerator<?> gen = context.getBean(OAuth2TokenGenerator.class);\n// sanity check at startup:\nOAuth2TokenContext probe = OAuth2TokenContext.builder()\n    .registeredClient(client).authorizedScopes(Set.of())\n    .tokenType(OAuth2TokenType.ACCESS_TOKEN)\n    .authorizationServerContext(AuthorizationServerContextHolder.getContext())\n    .build();\nif (gen.generate(probe) == null) {\n    throw new IllegalStateException(\"No token generator produces access tokens\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    registration = clientRegistrationService.register(registrationRequest);\n} catch (OAuth2AuthenticationException e) {\n    if (OAuth2ErrorCodes.SERVER_ERROR.equals(e.getError().getErrorCode())) {\n        logger.error(\"Token generator misconfigured: \" + e.getError().getDescription(), e);\n    }\n    throw e;\n}","preventionTips":["Compose the token generator with DelegatingOAuth2TokenGenerator covering both JWT and opaque access tokens","Add a startup smoke test that generates a token for a sample context","Keep JwtGenerator's JwtEncoder bean validated in integration tests","After Spring Authorization Server upgrades, re-verify the OAuth2TokenGenerator bean composition"],"tags":["oauth2","oidc","client-registration","token-generation","spring-authorization-server"],"backgroundTag":"oauth-token-exchange-failed","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}