spring-projects/spring-security · error · OAuth2AuthenticationException

oidc_provider_not_configured

oidc_provider_not_configured

Error message

An OpenID Connect Authentication Provider has not been configured. Check to ensure you include the dependency 'spring-security-oauth2-jose'.

What it means

During an OpenID Connect login flow, OidcAuthenticationRequestChecker authenticates the OAuth2LoginAuthenticationToken and, when the authorization request contains the 'openid' scope, requires an OidcAuthorizationCodeAuthenticationProvider to complete OIDC authentication. This AuthenticationException fires when that OIDC provider is absent from the provider manager — typically because spring-security-oauth2-jose is not on the classpath — so an OIDC login request cannot be processed even though the client registration/redirect was initiated with the openid scope.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java:814

	}

	private static class OidcAuthenticationRequestChecker implements AuthenticationProvider {

		@Override
		public Authentication authenticate(Authentication authentication) throws AuthenticationException {
			OAuth2LoginAuthenticationToken authorizationCodeAuthentication = (OAuth2LoginAuthenticationToken) authentication;
			OAuth2AuthorizationRequest authorizationRequest = authorizationCodeAuthentication.getAuthorizationExchange()
				.getAuthorizationRequest();
			if (authorizationRequest.getScopes().contains(OidcScopes.OPENID)) {
				// Section 3.1.2.1 Authentication Request -
				// https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest scope
				// REQUIRED. OpenID Connect requests MUST contain the "openid" scope
				// value.
				OAuth2Error oauth2Error = new OAuth2Error("oidc_provider_not_configured",
						"An OpenID Connect Authentication Provider has not been configured. "
								+ "Check to ensure you include the dependency 'spring-security-oauth2-jose'.",
						null);
				throw new OAuth2AuthenticationException(oauth2Error, oauth2Error.toString());
			}
			return null;
		}

		@Override
		public boolean supports(Class<?> authentication) {
			return OAuth2LoginAuthenticationToken.class.isAssignableFrom(authentication);
		}

	}

	private static final class OidcClientSessionEventListener implements ApplicationListener<AbstractSessionEvent> {

		private final Log logger = LogFactory.getLog(OidcClientSessionEventListener.class);

		private OidcSessionRegistry sessionRegistry = new InMemoryOidcSessionRegistry();

		/**

View on GitHub (pinned to 96852e8860)

Solutions

1. Add the 'spring-security-oauth2-jose' dependency so the OidcAuthorizationCodeAuthenticationProvider is auto-configured
2. Remove the 'openid' scope from the client registration if OIDC login is not intended
3. Verify oauth2Login() is configured and the provider is registered on the AuthenticationManager

When it happens

Trigger: Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java:814 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/2dd8bef2a785909e. Report an issue: GitHub.