spring-projects/spring-security · error · OAuth2AuthorizationCodeRequestAuthenticationException

invalid_scope

invalid_scope

Error message

OpenID Connect 1.0 authentication requests are restricted.

What it means

When OpenID Connect 1.0 is not enabled on the authorization server, the configurer installs an authentication request validator that rejects any authorization code request whose scope set contains 'openid'. It throws OAuth2AuthorizationCodeRequestAuthenticationException with code 'invalid_scope', since OIDC requests are only permitted when the OidcConfigurer is registered.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/authorization/OAuth2AuthorizationServerConfigurer.java:373

									((Authentication) authorizationCodeRequestAuthentication.getPrincipal())
										.getPrincipal());
						}
					}
				}
			});
		}
		else {
			// OpenID Connect is disabled.
			// Add an authentication validator that rejects authentication requests.
			Consumer<OAuth2AuthorizationCodeRequestAuthenticationContext> oidcAuthenticationRequestValidator = (
					authenticationContext) -> {
				OAuth2AuthorizationCodeRequestAuthenticationToken authorizationCodeRequestAuthentication = authenticationContext
					.getAuthentication();
				if (authorizationCodeRequestAuthentication.getScopes().contains(OidcScopes.OPENID)) {
					OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.INVALID_SCOPE,
							"OpenID Connect 1.0 authentication requests are restricted.",
							"https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1");
					throw new OAuth2AuthorizationCodeRequestAuthenticationException(error,
							authorizationCodeRequestAuthentication);
				}
			};
			OAuth2AuthorizationEndpointConfigurer authorizationEndpointConfigurer = getConfigurer(
					OAuth2AuthorizationEndpointConfigurer.class);
			authorizationEndpointConfigurer
				.addAuthorizationCodeRequestAuthenticationValidator(oidcAuthenticationRequestValidator);
			OAuth2PushedAuthorizationRequestEndpointConfigurer pushedAuthorizationRequestEndpointConfigurer = getConfigurer(
					OAuth2PushedAuthorizationRequestEndpointConfigurer.class);
			if (pushedAuthorizationRequestEndpointConfigurer != null) {
				pushedAuthorizationRequestEndpointConfigurer
					.addAuthorizationCodeRequestAuthenticationValidator(oidcAuthenticationRequestValidator);
			}
		}

		List<RequestMatcher> requestMatchers = new ArrayList<>();
		this.configurers.values().forEach((configurer) -> {
			configurer.init(httpSecurity);

View on GitHub (pinned to 96852e8860)

Solutions

1. Enable OpenID Connect 1.0 on the server: add .oidc(Customizer.withDefaults()) to the OAuth2AuthorizationServerConfigurer in your SecurityFilterChain.
2. Alternatively remove 'openid' from the client's requested scopes if OIDC behavior (id_token) is not needed.
3. Ensure the configurer's init is applied via http.applyer http.with(authorizationServerConfigurer, customizer) so the validator is registered where intended.
4. Check for a duplicate/separate filter chain that handles /oauth2/authorize without the OIDC configurer.

Example fix

// before
OAuth2AuthorizationServerConfigurer authorizationServer = new OAuth2AuthorizationServerConfigurer();
http.with(authorizationServer, Customizer.withDefaults());
// after
OAuth2AuthorizationServerConfigurer authorizationServer = new OAuth2AuthorizationServerConfigurer();
authorizationServer.oidc(Customizer.withDefaults());
http.with(authorizationServer, Customizer.withDefaults());

// Server side: fail fast at startup if clients need OIDC
Assert.state(
    oidcRequired == false || authorizationServerConfigurer.getOidc() != null,
    "Clients request the 'openid' scope but OIDC is not enabled; call .oidc(withDefaults())");

// Client side: strip openid scope when OIDC is not enabled
List<String> scopes = requestedScopes.stream()
    .filter(s -> !"openid".equals(s))
    .collect(Collectors.toList());

try {
    authorizeUri = client.authorizeUrl(state, scopes);
} catch (OAuth2AuthorizationCodeRequestAuthenticationException e) {
    if ("invalid_scope".equals(e.getError().getErrorCode())) {
        // retry without the 'openid' scope or enable OIDC on the server
    } else {
        throw e;
    }
}

When it happens

Trigger: A client sends an authorization request with scope 'openid' (e.g. scope=openid profile) to an authorization server configured with OAuth2AuthorizationServerConfigurer but WITHOUT .oidc(Customizer.withDefaults()) in the init(HttpSecurity) configuration.

Common situations: Developers following plain OAuth2 setup guides whose OIDC clients (spring-boot oidc login, keycloak-style clients) still request the 'openid' scope; enabling OIDC client side but not on the server; after refactoring that removed the .oidc() customizer.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• insufficient_scope
• oidc_provider_not_configured
• invalid_token
• invalid_id_token
• invalid_nonce

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5f87a8f13f0c1481. Report an issue: GitHub.