spring-projects/spring-security · error · OAuth2AuthenticationException

missing_user_info_uri

missing_user_info_uri

Error message

Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: ${registrationId}

What it means

DefaultReactiveOAuth2UserService.loadUser validates that the ClientRegistration's UserInfoEndpoint has a non-empty uri before issuing the reactive UserInfo request. If userInfoUri is blank it throws OAuth2AuthenticationException with code 'missing_user_info_uri'. The reactive user-info flow cannot proceed without an endpoint to fetch the authenticated user's claims.

Source

Thrown at oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultReactiveOAuth2UserService.java:100

	private Converter<OAuth2UserRequest, Converter<Map<String, Object>, Map<String, Object>>> attributesConverter = (
			request) -> (attributes) -> attributes;

	private WebClient webClient = WebClient.create();

	@Override
	public Mono<OAuth2User> loadUser(OAuth2UserRequest userRequest) throws OAuth2AuthenticationException {
		return Mono.defer(() -> {
			Assert.notNull(userRequest, "userRequest cannot be null");
			String userInfoUri = userRequest.getClientRegistration()
				.getProviderDetails()
				.getUserInfoEndpoint()
				.getUri();
			if (!StringUtils.hasText(userInfoUri)) {
				OAuth2Error oauth2Error = new OAuth2Error(MISSING_USER_INFO_URI_ERROR_CODE,
						"Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: "
								+ userRequest.getClientRegistration().getRegistrationId(),
						null);
				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
			}
			String userNameAttributeName = userRequest.getClientRegistration()
				.getProviderDetails()
				.getUserInfoEndpoint()
				.getUserNameAttributeName();
			if (!StringUtils.hasText(userNameAttributeName)) {
				OAuth2Error oauth2Error = new OAuth2Error(MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE,
						"Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: "
								+ userRequest.getClientRegistration().getRegistrationId(),
						null);
				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
			}
			AuthenticationMethod authenticationMethod = userRequest.getClientRegistration()
				.getProviderDetails()
				.getUserInfoEndpoint()
				.getAuthenticationMethod();
			WebClient.RequestHeadersSpec<?> requestHeadersSpec = getRequestHeaderSpec(userRequest, userInfoUri,
					authenticationMethod);

View on GitHub (pinned to 96852e8860)

Solutions

1. Add user-info-uri to provider config (spring.security.oauth2.client.provider.<id>.user-info-uri) or via ClientRegistration userInfoEndpoint().uri(...).
2. Use issuer-uri based registration so userinfo_endpoint is discovered from .well-known/openid-configuration.
3. If the id_token already contains all needed claims, ensure the flow uses OIDC id-token parsing instead of the UserInfo path.
4. Validate registrations at application startup to surface the missing uri before first login.

Example fix

// before (reactive)
spring.security.oauth2.client.provider.myidp.token-uri=https://idp.example.com/token
# user-info-uri missing

// after
spring.security.oauth2.client.provider.myidp.authorization-uri=https://idp.example.com/authorize
spring.security.oauth2.client.provider.myidp.token-uri=https://idp.example.com/token
spring.security.oauth2.client.provider.myidp.user-info-uri=https://idp.example.com/userinfo
spring.security.oauth2.client.provider.myidp.user-name-attribute=sub

ClientRegistration reg = reactiveRepository.findByRegistrationId("myclient").block();
if (reg == null || !StringUtils.hasText(reg.getProviderDetails().getUserInfoEndpoint().getUri())) {
    throw new IllegalStateException("reactive registration myclient is missing user-info-uri");
}

catch (OAuth2AuthenticationException ex) {
    if ("missing_user_info_uri".equals(ex.getError().getErrorCode())) {
        // configuration defect: surface at startup, not at login time
    }
}

When it happens

Trigger: In a WebFlux/reactive app, ServerOAuth2LoginAuthenticationWebFilter triggers user-info based login while the ClientRegistration (from ReactiveClientRegistrationRepository / spring config) lacks user-info-uri.

Common situations: Reactive OAuth2 login with a manually defined provider missing user-info-uri; provider metadata discovery (issuer-uri) failing silently so userinfo_endpoint absent; non-OIDC OAuth2 provider configured reactively without explicit userinfo endpoint.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing_user_name_attribute
• missing_user_info_uri
• missing_user_name_attribute
• invalid_scope
• oidc_provider_not_configured

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/363f8c908e39fef4. Report an issue: GitHub.