spring-projects/spring-security · error · OAuth2AuthenticationException

oidc_provider_not_configured

oidc_provider_not_configured

Error message

An OpenID Connect Authentication Provider has not been configured. Check to ensure you include the dependency 'spring-security-oauth2-jose'.

What it means

Spring Security's OAuth2LoginAuthenticationProvider requires an OpenID Connect authentication provider to handle OIDC (openid scope) logins. When none is configured, authenticate() (OAuth2LoginBeanDefinitionParser.java:411) throws OAuth2AuthenticationException with code 'oidc_provider_not_configured'. This typically means the spring-security-oauth2-jose dependency, which supplies the JwtDecoder/OIDC provider machinery, is absent from the classpath.

Source

Thrown at config/src/main/java/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParser.java:411

		@Override
		public Authentication authenticate(Authentication authentication) throws AuthenticationException {
			OAuth2LoginAuthenticationToken authorizationCodeAuthentication = (OAuth2LoginAuthenticationToken) authentication;
			if (!authorizationCodeAuthentication.getAuthorizationExchange()
				.getAuthorizationRequest()
				.getScopes()
				.contains(OidcScopes.OPENID)) {
				return null;
			}
			// Section 3.1.2.1 Authentication Request -
			// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest scope
			// REQUIRED. OpenID Connect requests MUST contain the "openid" scope
			// value.
			OAuth2Error oauth2Error = new OAuth2Error("oidc_provider_not_configured",
					"An OpenID Connect Authentication Provider has not been configured. "
							+ "Check to ensure you include the dependency 'spring-security-oauth2-jose'.",
					null);
			throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
		}

		@Override
		public boolean supports(Class<?> authentication) {
			return OAuth2LoginAuthenticationToken.class.isAssignableFrom(authentication);
		}

	}

	/**
	 * Wrapper bean class to provide configuration from applicationContext.
	 */
	private static class OAuth2LoginBeanConfig implements ApplicationContextAware {

		private ApplicationContext context;

		@Override
		public void setApplicationContext(ApplicationContext context) throws BeansException {

View on GitHub (pinned to 96852e8860)

Solutions

1. Add the spring-security-oauth2-jose dependency to your build.
2. Configure a JwtDecoder or client registration that enables OIDC provider setup in <oauth2-login>.
3. Remove the 'openid' scope if you intend plain OAuth2 login without OIDC.

Example fix

// before
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-oauth2-client</artifactId>
</dependency>
// after
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-oauth2-client</artifactId>
</dependency>
<dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-oauth2-jose</artifactId>
</dependency>

Class.forName("org.springframework.security.oauth2.jwt.JwtDecoder");
assert ctx.getBeanNamesForType(JwtDecoder.class).length > 0 || clientRegistrationUsesOpenIdScopes() == false;

try { authenticationManager.authenticate(token); } catch (OAuth2AuthenticationException e) { if ("oidc_provider_not_configured".equals(e.getError().getErrorCode())) { throw new ConfigurationException("Add spring-security-oauth2-jose and configure a JwtDecoder"); } throw e; }

When it happens

Trigger: A login request with the 'openid' scope reaches OAuth2LoginAuthenticationProvider.authenticate() while the application context has no OIDC provider registered — usually because spring-security-oauth2-jose is missing or OIDC was not configured in <oauth2-login>.

Common situations: Developers adding the oauth2-client dependency but forgetting oauth2-jose; using Google/Azure AD (which mandate openid scope) with incomplete dependencies; upgrading Spring Security and dropping a transitive dependency.

Understand the failure class

Background: "X is not installed. Please install it with pip install Y": missing optional dependency errors — ImportError/ValueError raised when a library's optional extra was never installed — this error's family across 22 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• invalid_scope
• insufficient_scope
• invalid_token
• invalid_id_token
• invalid_nonce

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/87eb62bc51132a63. Report an issue: GitHub.