spring-projects/spring-security · error · OAuth2AuthenticationException

missing_user_info_uri

missing_user_info_uri

Error message

Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: ${registrationId}

What it means

DefaultOAuth2UserService.getUserNameAttributeName validates that the ClientRegistration's UserInfoEndpoint has a non-empty uri before it can fetch claims. When user-info-uri is blank, it throws OAuth2AuthenticationException with code 'missing_user_info_uri'. This happens because the user-info flow (as opposed to the JWT-based id-token flow) depends entirely on the UserInfo endpoint.

Source

Thrown at oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java:178

					+ "as defined in OpenID Connect 1.0: 'https://openid.net/specs/openid-connect-core-1_0.html#UserInfo'";
			OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE, errorMessage, null);
			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);
		}
		catch (RestClientException ex) {
			OAuth2Error oauth2Error = new OAuth2Error(INVALID_USER_INFO_RESPONSE_ERROR_CODE,
					"An error occurred while attempting to retrieve the UserInfo Resource: " + ex.getMessage(), null);
			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString(), ex);
		}
	}

	private String getUserNameAttributeName(OAuth2UserRequest userRequest) {
		if (!StringUtils
			.hasText(userRequest.getClientRegistration().getProviderDetails().getUserInfoEndpoint().getUri())) {
			OAuth2Error oauth2Error = new OAuth2Error(MISSING_USER_INFO_URI_ERROR_CODE,
					"Missing required UserInfo Uri in UserInfoEndpoint for Client Registration: "
							+ userRequest.getClientRegistration().getRegistrationId(),
					null);
			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
		}
		String userNameAttributeName = userRequest.getClientRegistration()
			.getProviderDetails()
			.getUserInfoEndpoint()
			.getUserNameAttributeName();
		if (!StringUtils.hasText(userNameAttributeName)) {
			OAuth2Error oauth2Error = new OAuth2Error(MISSING_USER_NAME_ATTRIBUTE_ERROR_CODE,
					"Missing required \"user name\" attribute name in UserInfoEndpoint for Client Registration: "
							+ userRequest.getClientRegistration().getRegistrationId(),
					null);
			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
		}
		return userNameAttributeName;
	}

	private Collection<GrantedAuthority> getAuthorities(OAuth2AccessToken token, Map<String, Object> attributes,
			String userNameAttributeName) {
		Collection<GrantedAuthority> authorities = new LinkedHashSet<>();

View on GitHub (pinned to 96852e8860)

Solutions

1. Add user-info-uri to the provider details (spring.security.oauth2.client.provider.<id>.user-info-uri or programmatically userInfoEndpoint().uri(...)).
2. If the provider is OIDC-compliant, use issuer-uri based registration so userinfo_endpoint is discovered automatically.
3. Alternatively avoid the UserInfo call by relying on id_token claims (ensure the required claims are present and userNameAttributeName maps to an id_token claim).
4. Validate the ClientRegistration at startup (fail fast in a @Configuration) so the missing uri is caught before a user tries to log in.

Example fix

// before
spring.security.oauth2.client.registration.myclient.client-id=id
spring.security.oauth2.client.registration.myclient.client-secret=secret
# no provider user-info-uri

// after
spring.security.oauth2.client.registration.myclient.provider=myprovider
spring.security.oauth2.client.provider.myprovider.authorization-uri=https://idp.example.com/authorize
spring.security.oauth2.client.provider.myprovider.token-uri=https://idp.example.com/token
spring.security.oauth2.client.provider.myprovider.user-info-uri=https://idp.example.com/userinfo
spring.security.oauth2.client.provider.myprovider.user-name-attribute=sub

ClientRegistration reg = repository.findByRegistrationId("myclient");
if (reg == null || !StringUtils.hasText(reg.getProviderDetails().getUserInfoEndpoint().getUri())) {
    throw new IllegalStateException("user-info-uri must be configured for myclient");
}

catch (OAuth2AuthenticationException ex) {
    if ("missing_user_info_uri".equals(ex.getError().getErrorCode())) {
        // config bug: fail startup or redirect to an error page with guidance
    }
}

When it happens

Trigger: ClientRegistration built via ClientRegistrations/ClientRegistration.withRegistrationId(...) without user-info-uri (or with an empty string), and the app takes the user-info path (e.g. OIDC provider that does not put email claim in id_token, or OAuth2 login for a non-OIDC provider), causing loadUser to call getUserNameAttributeName.

Common situations: Plain OAuth2 providers (GitHub-style manual registration) where the developer forgot user-info-uri; dynamic provider config missing userinfo_endpoint; typos like userNameAttributeName set but uri left blank; upgrading and switching from id-token-only config to user-info config.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing_user_name_attribute
• invalid_user_info_response
• missing_user_info_uri
• missing_user_name_attribute
• invalid_user_info_response

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/17e751f0d57a9354. Report an issue: GitHub.