spring-projects/spring-security · error · IllegalArgumentException

The issuer identifier (${issuer}) cannot be set when isMulti

Error message

The issuer identifier (${issuer}) cannot be set when isMultipleIssuersAllowed() is true.

What it means

This IllegalArgumentException from AuthorizationServerSettings.Builder.build prevents constructing settings that both define a fixed issuer and enable multiple issuers. A fixed issuer is incompatible with multi-issuer mode, where the issuer must be derived per-request/tenant. The library rejects the conflicting configuration eagerly at startup.

Source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/settings/AuthorizationServerSettings.java:411

		/**
		 * Sets the OpenID Connect 1.0 Logout endpoint.
		 * @param oidcLogoutEndpoint the OpenID Connect 1.0 Logout endpoint
		 * @return the {@link Builder} for further configuration
		 */
		public Builder oidcLogoutEndpoint(String oidcLogoutEndpoint) {
			return setting(ConfigurationSettingNames.AuthorizationServer.OIDC_LOGOUT_ENDPOINT, oidcLogoutEndpoint);
		}

		/**
		 * Builds the {@link AuthorizationServerSettings}.
		 * @return the {@link AuthorizationServerSettings}
		 */
		@Override
		public AuthorizationServerSettings build() {
			AuthorizationServerSettings authorizationServerSettings = new AuthorizationServerSettings(getSettings());
			if (authorizationServerSettings.getIssuer() != null
					&& authorizationServerSettings.isMultipleIssuersAllowed()) {
				throw new IllegalArgumentException("The issuer identifier (" + authorizationServerSettings.getIssuer()
						+ ") cannot be set when isMultipleIssuersAllowed() is true.");
			}
			return authorizationServerSettings;
		}

	}

}

View on GitHub (pinned to 96852e8860)

Solutions

1. Remove the .issuer(...) call when multipleIssuersAllowed(true) is set, letting the issuer be resolved per request
2. Or set multipleIssuersAllowed(false) if a single fixed issuer is intended
3. Check external configuration (properties) for a conflicting issuer value

Example fix

// before
AuthorizationServerSettings.builder().issuer("https://example.com").multipleIssuersAllowed(true).build();
// after
AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();

// Validate builder inputs before build()
boolean conflicting = issuer != null && multipleIssuersAllowed;
if (conflicting) throw new IllegalStateException("issuer set while multipleIssuersAllowed=true");

try {
    settings = AuthorizationServerSettings.builder()...
        .build();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("isMultipleIssuersAllowed")) {
        settings = AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();
    }
}

When it happens

Trigger: Calling AuthorizationServerSettings.builder().issuer("https://...").multipleIssuersAllowed(true).build() — any combination where getIssuer() != null and isMultipleIssuersAllowed() is true.

Common situations: Upgrading to multi-tenant issuer support while keeping an existing issuer(...) setting; enabling multipleIssuersAllowed(true) via a property while a default issuer is configured elsewhere; copying single-tenant config into a multi-tenant deployment.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• No enum constant org.springframework.security.oauth2.client.
• server_error
• missing_signature_verifier
• missing_signature_verifier
• Duplicate key ${registrationId}

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5b4c641b98d1074b. Report an issue: GitHub.