spring-projects/spring-security · error · OAuth2AuthenticationException

missing_signature_verifier

missing_signature_verifier

Error message

Failed to find a Signature Verifier for Client Registration: '{}'. Check to ensure you have configured the JwkSet URI.

What it means

When validating an OpenID Connect back-channel logout token, OidcBackChannelLogoutAuthenticationProvider builds a JwtDecoder per ClientRegistration; if the registration has no jwkSetUri configured, no SignatureVerifier/JwkSetUriJwtDecoderBuilder can be created, so this IllegalStateException fires. It means the client registration used for the logout request lacks the provider's JWK Set URI, making signature verification of the logout+jwt token impossible and the logout unverifiable.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java:78

	private JwtDecoderFactory<ClientRegistration> logoutTokenDecoderFactory;

	/**
	 * Construct an {@link OidcBackChannelLogoutAuthenticationProvider}.
	 */
	OidcBackChannelLogoutAuthenticationProvider() {
		JwtTypeValidator type = new JwtTypeValidator("JWT", "logout+jwt");
		type.setAllowEmpty(true);
		Function<ClientRegistration, OAuth2TokenValidator<Jwt>> jwtValidator = (clientRegistration) -> JwtValidators
			.createDefaultWithValidators(type, new OidcBackChannelLogoutTokenValidator(clientRegistration));
		this.logoutTokenDecoderFactory = (clientRegistration) -> {
			String jwkSetUri = clientRegistration.getProviderDetails().getJwkSetUri();
			if (!StringUtils.hasText(jwkSetUri)) {
				OAuth2Error oauth2Error = new OAuth2Error("missing_signature_verifier",
						"Failed to find a Signature Verifier for Client Registration: '"
								+ clientRegistration.getRegistrationId()
								+ "'. Check to ensure you have configured the JwkSet URI.",
						null);
				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
			}
			NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).build();
			decoder.setJwtValidator(jwtValidator.apply(clientRegistration));
			decoder.setClaimSetConverter(OidcIdTokenDecoderFactory.createDefaultClaimTypeConverter());
			return decoder;
		};
	}

	/**
	 * {@inheritDoc}
	 */
	@Override
	public Authentication authenticate(Authentication authentication) throws AuthenticationException {
		if (!(authentication instanceof OidcLogoutAuthenticationToken token)) {
			return null;
		}
		String logoutToken = token.getLogoutToken();
		ClientRegistration registration = token.getClientRegistration();

View on GitHub (pinned to 96852e8860)

Solutions

1. Set jwkSetUri on the ClientRegistration (e.g. via issuer-uri discovery or explicit .jwkSetUri(...))
2. Confirm the OIDC provider publishes its JWK Set and the URI is reachable
3. Verify the clientConfigurationMetadata/back-channel configuration matches the registration used at runtime

When it happens

Trigger: Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OidcBackChannelLogoutAuthenticationProvider.java:78 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/a0bf63b85bb9cdbc. Report an issue: GitHub.