spring-projects/spring-security · error · OAuth2AuthenticationException

server_error

server_error

Error message

Unable to process the OpenID Connect 1.0 RP-Initiated Logout response.

What it means

This OAuth2AuthenticationException with server_error is thrown by OidcLogoutAuthenticationSuccessHandler.onAuthenticationSuccess when the Authentication is not an OidcLogoutAuthenticationToken. The handler can only process RP-Initiated Logout results, so an unexpected authentication type indicates an internal misconfiguration. It logs the actual type before throwing.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/oidc/web/authentication/OidcLogoutAuthenticationSuccessHandler.java:78

	private final RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

	private final SecurityContextLogoutHandler securityContextLogoutHandler = new SecurityContextLogoutHandler();

	private LogoutHandler logoutHandler = this::performLogout;

	@Override
	public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
			Authentication authentication) throws IOException, ServletException {

		if (!(authentication instanceof OidcLogoutAuthenticationToken)) {
			if (this.logger.isErrorEnabled()) {
				this.logger.error(Authentication.class.getSimpleName() + " must be of type "
						+ OidcLogoutAuthenticationToken.class.getName() + " but was "
						+ authentication.getClass().getName());
			}
			OAuth2Error error = new OAuth2Error(OAuth2ErrorCodes.SERVER_ERROR,
					"Unable to process the OpenID Connect 1.0 RP-Initiated Logout response.", null);
			throw new OAuth2AuthenticationException(error);
		}

		this.logoutHandler.logout(request, response, authentication);

		sendLogoutRedirect(request, response, authentication);
	}

	/**
	 * Sets the {@link LogoutHandler} used for performing logout.
	 * @param logoutHandler the {@link LogoutHandler} used for performing logout
	 */
	public void setLogoutHandler(LogoutHandler logoutHandler) {
		Assert.notNull(logoutHandler, "logoutHandler cannot be null");
		this.logoutHandler = logoutHandler;
	}

	private void performLogout(HttpServletRequest request, HttpServletResponse response,
			@Nullable Authentication authentication) {

View on GitHub (pinned to 96852e8860)

Solutions

1. Ensure the success handler is only wired to the OidcLogoutAuthentication processing path (OidcLogoutEndpointFilter)
2. Check the authentication provider that produces the result actually emits OidcLogoutAuthenticationToken
3. Review the log line naming the unexpected Authentication type to find the miswired filter
4. If handling generic logout, use a different/independent success handler

Example fix

// before: attached to generic logout
.exceptionHandling(e -> e.authenticationEntryPoint(new OidcLogoutAuthenticationSuccessHandler(...)))
// after: attach where OidcLogoutAuthenticationToken is produced
.addFilterBefore(oidcLogoutEndpointFilter, ...); // filter uses the handler on success

// Only wire the handler where OidcLogoutAuthenticationToken is produced
if (!(authentication instanceof OidcLogoutAuthenticationToken)) {
    throw new IllegalStateException("Handler wired to wrong filter");
}

boolean isOidcLogout(Authentication a) {
    return a instanceof OidcLogoutAuthenticationToken;
}

try {
    handler.onAuthenticationSuccess(request, response, authentication);
} catch (OAuth2AuthenticationException e) {
    if ("server_error".equals(e.getError().getErrorCode())) {
        logger.error("RP-Initiated Logout handler misconfigured: {}", e.getError());
    }
}

When it happens

Trigger: Registering OidcLogoutAuthenticationSuccessHandler on a filter/handler chain that delivers a different Authentication type (e.g. a plain logout token or another token type) to onAuthenticationSuccess.

Common situations: Custom security filter chains wiring the success handler to the wrong authentication provider; misordered filters so another authentication type reaches the handler; copying example code into an unrelated endpoint's success handler.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• kerberosClient must be set
• userDetailsService must be set
• An error occurred writing the OpenID Provider Configuration:
• Failed to decode SAMLResponse
• SAML payload exceeded maximum size of

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/114e8ae72d634c94. Report an issue: GitHub.