spring-projects/spring-security · error · IllegalArgumentException

The issuer identifier

Error message

The issuer identifier (${issuer}) cannot be set when isMultipleIssuersAllowed() is true.

What it means

This IllegalArgumentException from AuthorizationServerSettings.Builder.build prevents constructing settings that both define a fixed issuer and enable multiple issuers. A fixed issuer is incompatible with multi-issuer mode, where the issuer must be derived per-request/tenant. The library rejects the conflicting configuration eagerly at startup.

Solutions

1. Remove the .issuer(...) call when multipleIssuersAllowed(true) is set, letting the issuer be resolved per request
2. Or set multipleIssuersAllowed(false) if a single fixed issuer is intended
3. Check external configuration (properties) for a conflicting issuer value

Example fix

// before
AuthorizationServerSettings.builder().issuer("https://example.com").multipleIssuersAllowed(true).build();
// after
AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();

// Validate builder inputs before build()
boolean conflicting = issuer != null && multipleIssuersAllowed;
if (conflicting) throw new IllegalStateException("issuer set while multipleIssuersAllowed=true");

try {
    settings = AuthorizationServerSettings.builder()...
        .build();
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("isMultipleIssuersAllowed")) {
        settings = AuthorizationServerSettings.builder().multipleIssuersAllowed(true).build();
    }
}

When it happens

Trigger: Calling AuthorizationServerSettings.builder().issuer("https://...").multipleIssuersAllowed(true).build() — any combination where getIssuer() != null and isMultipleIssuersAllowed() is true.

Common situations: Upgrading to multi-tenant issuer support while keeping an existing issuer(...) setting; enabling multipleIssuersAllowed(true) via a property while a default issuer is configured elsewhere; copying single-tenant config into a multi-tenant deployment.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• client_registration_not_found
• Duplicate key
• Invalid Authorization Grant Type
• Invalid Client Registration with Id
• missing_signature_verifier

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/5b4c641b98d1074b. Report an issue: GitHub.

Appendix: source

Thrown at oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/settings/AuthorizationServerSettings.java:411

		/**
		 * Sets the OpenID Connect 1.0 Logout endpoint.
		 * @param oidcLogoutEndpoint the OpenID Connect 1.0 Logout endpoint
		 * @return the {@link Builder} for further configuration
		 */
		public Builder oidcLogoutEndpoint(String oidcLogoutEndpoint) {
			return setting(ConfigurationSettingNames.AuthorizationServer.OIDC_LOGOUT_ENDPOINT, oidcLogoutEndpoint);
		}

		/**
		 * Builds the {@link AuthorizationServerSettings}.
		 * @return the {@link AuthorizationServerSettings}
		 */
		@Override
		public AuthorizationServerSettings build() {
			AuthorizationServerSettings authorizationServerSettings = new AuthorizationServerSettings(getSettings());
			if (authorizationServerSettings.getIssuer() != null
					&& authorizationServerSettings.isMultipleIssuersAllowed()) {
				throw new IllegalArgumentException("The issuer identifier (" + authorizationServerSettings.getIssuer()
						+ ") cannot be set when isMultipleIssuersAllowed() is true.");
			}
			return authorizationServerSettings;
		}

	}

}

View on GitHub (pinned to 96852e8860)