spring-projects/spring-security · error · HttpMessageNotWritableException

An error occurred writing the OpenID Provider Configuration:

Error message

An error occurred writing the OpenID Provider Configuration: ${ex.getMessage()}

What it means

This HttpMessageNotWritableException is thrown by OidcProviderConfigurationHttpMessageConverter.writeInternal when converting the OpenID Provider Configuration to parameters or serializing them to JSON fails. It wraps the underlying exception's message, so the root cause (e.g. JSON conversion failure) is appended. The library treats any failure to render the discovery document as a non-writable response.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/http/converter/OidcProviderConfigurationHttpMessageConverter.java:100

		}
		catch (Exception ex) {
			throw new HttpMessageNotReadableException(
					"An error occurred reading the OpenID Provider Configuration: " + ex.getMessage(), ex,
					inputMessage);
		}
	}

	@Override
	protected void writeInternal(OidcProviderConfiguration providerConfiguration, HttpOutputMessage outputMessage)
			throws HttpMessageNotWritableException {
		try {
			Map<String, Object> providerConfigurationResponseParameters = this.providerConfigurationParametersConverter
				.convert(providerConfiguration);
			this.jsonMessageConverter.write(providerConfigurationResponseParameters, STRING_OBJECT_MAP.getType(),
					MediaType.APPLICATION_JSON, outputMessage);
		}
		catch (Exception ex) {
			throw new HttpMessageNotWritableException(
					"An error occurred writing the OpenID Provider Configuration: " + ex.getMessage(), ex);
		}
	}

	/**
	 * Sets the {@link Converter} used for converting the OpenID Provider Configuration
	 * parameters to an {@link OidcProviderConfiguration}.
	 * @param providerConfigurationConverter the {@link Converter} used for converting to
	 * an {@link OidcProviderConfiguration}
	 */
	public final void setProviderConfigurationConverter(
			Converter<Map<String, Object>, OidcProviderConfiguration> providerConfigurationConverter) {
		Assert.notNull(providerConfigurationConverter, "providerConfigurationConverter cannot be null");
		this.providerConfigurationConverter = providerConfigurationConverter;
	}

	/**
	 * Sets the {@link Converter} used for converting the

View on GitHub (pinned to 96852e8860)

Solutions

Read the wrapped cause message (ex.getMessage()) to find the actual serialization failure
Check that a JSON converter (Jackson) is on the classpath and usable by the converter
Inspect any custom providerConfiguration consumer for non-JSON-serializable values
Set a working converter via setJsonMessageConverter()/setProviderConfigurationParametersConverter() if customized

Example fix

// before: customizer adds a non-serializable object
.customProviderConfiguration(c -> c.put("custom", new Object()))
// after: use JSON-friendly values only
.customProviderConfiguration(c -> c.put("custom", "value"))

Defensive patterns

Strategy: try-catch

Validate before calling

// Ensure configuration values are JSON-serializable before conversion
parameters.forEach((k, v) -> {
    new ObjectMapper().writeValueAsString(v); // throws if not serializable
});

Type guard

boolean isJsonSerializable(Object v) {
    try { new ObjectMapper().writeValueAsString(v); return true; }
    catch (JsonProcessingException e) { return false; }
}

Try / catch

try {
    converter.write(OidcProviderConfiguration.builder().build(), ...);
} catch (HttpMessageNotWritableException e) {
    logger.error("Provider configuration write failed: {}", e.getCause(), e);
}

Prevention

Only put JSON-serializable values in provider configuration customizers
Keep Jackson on the classpath and do not override the default converter without need
Smoke-test the discovery endpoint (.well-known/openid-configuration) at startup

When it happens

Trigger: The configured providerConfigurationParametersConverter throws during convert(), or the injected jsonMessageConverter fails to write the Map<String,Object> parameters as JSON to the HTTP output message.

Common situations: A custom HttpMessageConverter (e.g. Jackson) is misconfigured or missing from the classpath; a custom OidcProviderConfiguration customizer puts a non-serializable value into the configuration map; serialization fails on unusual parameter values.

Understand the failure class

Background: json.Marshal / "failed to marshal" errors in Go: why "unsupported type" happens and how to fix it — this error's family across 22 libraries.

Related errors

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/30b44ca7062287eb. Report an issue: GitHub.