spring-projects/spring-security · error · OAuth2AuthenticationException

Invalid Client Registration: + fieldName

Error message

Invalid Client Registration: + fieldName

What it means

Generic validation failure for an OIDC dynamic client registration request. throwInvalidClientRegistration is the helper registerClient uses to reject any metadata field that violates the spec, embedding the failing field name in the message and an OAuth2 error code (usually invalid_client_metadata or invalid_redirect_uri).

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/authentication/OidcClientRegistrationAuthenticationProvider.java:405

		if ("none".equals(authenticationSigningAlgorithm)) {
			return false;
		}

		if (ClientAuthenticationMethod.PRIVATE_KEY_JWT.getValue().equals(authenticationMethod)) {
			return clientRegistration.getJwkSetUrl() != null && (!StringUtils.hasText(authenticationSigningAlgorithm)
					|| SignatureAlgorithm.from(authenticationSigningAlgorithm) != null);
		}
		else {
			// client_secret_jwt
			return !StringUtils.hasText(authenticationSigningAlgorithm)
					|| MacAlgorithm.from(authenticationSigningAlgorithm) != null;
		}
	}

	private static void throwInvalidClientRegistration(String errorCode, String fieldName) {
		OAuth2Error error = new OAuth2Error(errorCode, "Invalid Client Registration: " + fieldName, ERROR_URI);
		throw new OAuth2AuthenticationException(error);
	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Read the fieldName in the message and correct that exact property in the registration metadata JSON
2. Ensure redirect_uris, if present, are absolute HTTPS/HTTP URIs and grant_types/response_types are spec-valid strings
3. Check which error code accompanies the message (invalid_client_metadata vs invalid_redirect_uri) to target metadata vs redirect validation
4. If registering programmatically, validate metadata against RegisteredClient/ClientSettings conventions before calling the endpoint

Example fix

// before
{
  "redirect_uris": ["http://"],
  "token_endpoint_auth_method": "unknown_method"
}
// after
{
  "redirect_uris": ["https://client.example.org/callback"],
  "token_endpoint_auth_method": "client_secret_basic"
}

Map<String,Object> metadata = registrationJson;
if (metadata.get("client_name") == null || metadata.get("client_name").toString().isBlank()) {
    throw new IllegalArgumentException("client_name is required");
}
String authMethod = (String) metadata.getOrDefault("token_endpoint_auth_method", "client_secret_basic");
Set.of("none","client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt")
    .contains(authMethod); // else fix before submitting

When it happens

Trigger: A POST /connect/register request whose metadata fails static validation in OidcClientRegistrationAuthenticationProvider.registerClient — e.g. client_name missing/empty where required, unsupported token_endpoint_auth_method, invalid jwks/jwks_uri combination, or a disallowed grant_type.

Common situations: Clients sending registration JSON with a null or malformed field, an authentication method the server doesn't accept, or both jwks and jwks_uri supplied; also common after spec updates tighten validation in newer Spring Authorization Server versions.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• server_error
• Invalid Client Registration: + fieldName
• Invalid Client Registration: + fieldName
• invalid_request
• invalid_redirect_uri

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/382db819d97f5159. Report an issue: GitHub.