spring-projects/spring-security · error · OAuth2AuthenticationException

missing_signature_verifier

missing_signature_verifier

Error message

Failed to find a Signature Verifier for Client Registration: '{registrationId}'. Check to ensure you have configured the JwkSet URI.

What it means

OidcBackChannelLogoutReactiveAuthenticationManager builds a NimbusReactiveJwtDecoder per client registration to verify back-channel logout tokens. It requires a JWK Set URI on the client registration; if jwkSetUri is blank it throws an OAuth2AuthenticationException with code 'missing_signature_verifier'.

Source

Thrown at config/src/main/java/org/springframework/security/config/web/server/OidcBackChannelLogoutReactiveAuthenticationManager.java:84

	private ReactiveJwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory;

	/**
	 * Construct an {@link OidcBackChannelLogoutReactiveAuthenticationManager}.
	 */
	OidcBackChannelLogoutReactiveAuthenticationManager() {
		JwtTypeValidator type = new JwtTypeValidator("JWT", "logout+jwt");
		type.setAllowEmpty(true);
		Function<ClientRegistration, OAuth2TokenValidator<Jwt>> jwtValidator = (clientRegistration) -> JwtValidators
			.createDefaultWithValidators(type, new OidcBackChannelLogoutTokenValidator(clientRegistration));
		this.logoutTokenDecoderFactory = (clientRegistration) -> {
			String jwkSetUri = clientRegistration.getProviderDetails().getJwkSetUri();
			if (!StringUtils.hasText(jwkSetUri)) {
				OAuth2Error oauth2Error = new OAuth2Error("missing_signature_verifier",
						"Failed to find a Signature Verifier for Client Registration: '"
								+ clientRegistration.getRegistrationId()
								+ "'. Check to ensure you have configured the JwkSet URI.",
						null);
				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
			}
			NimbusReactiveJwtDecoder decoder = NimbusReactiveJwtDecoder.withJwkSetUri(jwkSetUri).build();
			decoder.setJwtValidator(jwtValidator.apply(clientRegistration));
			decoder.setClaimSetConverter(
					new ClaimTypeConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverters()));
			return decoder;
		};
	}

	/**
	 * {@inheritDoc}
	 */
	@Override
	public Mono<Authentication> authenticate(Authentication authentication) throws AuthenticationException {
		if (!(authentication instanceof OidcLogoutAuthenticationToken token)) {
			return Mono.empty();
		}
		String logoutToken = token.getLogoutToken();

View on GitHub (pinned to 96852e8860)

Solutions

1. Set the jwkSetUri on the ClientRegistration (ClientRegistration.withRegistrationId(...).jwkSetUri("https://idp/.well-known/jwks.json"))
2. Ensure issuer-uri based registration resolves provider metadata containing jwks_uri
3. If the provider has no JWK Set endpoint, back-channel logout token verification cannot work; use a provider that signs and exposes JWKS

Example fix

// before
ClientRegistration.withRegistrationId("my-idp")
    .issuerUri("https://idp.example.com")
    .build();

// after
ClientRegistration.withRegistrationId("my-idp")
    .issuerUri("https://idp.example.com")
    .jwkSetUri("https://idp.example.com/.well-known/jwks.json")
    .build();

if (!StringUtils.hasText(clientRegistration.getProviderDetails().getJwkSetUri())) {
  throw new IllegalStateException("ClientRegistration '" + clientRegistration.getRegistrationId()
      + "' needs a jwkSetUri for back-channel logout");
}

try {
  authenticationManager.authenticate(logoutToken);
} catch (OAuth2AuthenticationException e) {
  if ("missing_signature_verifier".equals(e.getError().getErrorCode())) {
    // reconfigure the ClientRegistration with a jwkSetUri
  }
}

When it happens

Trigger: Enabling OIDC back-channel logout support (oidcLogout in reactive ServerHttpSecurity) while the ClientRegistration used has no jwkSetUri configured (e.g. only an issuer or client authentication method set, or a private-key jwt client).

Common situations: Configuring a reactive OAuth2 login client whose provider metadata does not yield a jwks_uri; hand-built ClientRegistration missing jwkSetUri; registering a custom client registration bean without the JWK Set endpoint.

Related errors

• invalid_id_token
• invalid_id_token
• missing_signature_verifier
• missing_signature_verifier
• invalid_user_info_response

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/7edbb3563a9d8362. Report an issue: GitHub.