首次实现Azure AD B2C遇Issuer配置解析失败问题求助

首次在Spring应用中集成Azure AD B2C OAuth2认证，配置参数后启动报错，提示无法解析提供的Issuer URI。浏览器直接访问该URI能正常返回OpenID配置JSON，但问题仍存在。

配置信息 #

application.properties #

spring.application.name=Azure B2C SSO Sample

logging.level.org.springframework.security=trace
logging.level.org.springframework.web=trace

spring.security.oauth2.client.registration.azure.client-id=d9353b2a-a3c1-49c2-9252-77fxxxxxx
spring.security.oauth2.client.registration.azure.client-secret=Idv8Q~BL1GRyirEaO-AXDaSQgFxxxxxx

spring.security.oauth2.client.registration.azure.redirect-uri=http://localhost:8080/login/oauth2/code/azure
spring.security.oauth2.client.registration.azure.authorization-grant-type=authorization_code
spring.security.oauth2.client.registration.azure.client-authentication-method=post
spring.security.oauth2.client.provider.azure.issuer-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signupsignin

SecurityConfig.java #

package config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated() // 保护所有请求
            )
            .oauth2Login(oauth2 -> oauth2 // 配置OAuth2登录
                .authorizationEndpoint(authorization -> 
                    authorization.baseUri("/oauth2/authorize")) // 自定义授权端点
                .redirectionEndpoint(redirection -> 
                    redirection.baseUri("/login/oauth2/code/*")) // 自定义重定向端点
            )
            .logout(logout -> 
                logout.logoutSuccessUrl("/").permitAll() // 登出后重定向到首页
            );

        return http.build(); // 返回构建好的HttpSecurity
    }
}

报错信息 #

Caused by: java.lang.IllegalArgumentException: Unable to resolve Configuration with the provided Issuer of "https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/v2.0/.well-known/openid-configuration?p=B2C_1_signupsignin"
    at org.springframework.security.oauth2.client.registration.ClientRegistrations.getBuilder(ClientRegistrations.java:231) ~[spring-security-oauth2-client-6.3.3.jar:6.3.3]
    at org.springframework.security.oauth2.client.registration.ClientRegistrations.fromIssuerLocation(ClientRegistrations.java:152) ~[spring-security-oauth2-client-6.3.3.jar:6.3.3]
    at org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper.getBuilderFromIssuerIfPossible(OAuth2ClientPropertiesMapper.java:97) ~[spring-boot-autoconfigure-3.3.4.jar:3.3.4]
    at org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper.getClientRegistration(OAuth2ClientPropertiesMapper.java:71) ~[spring-boot-autoconfigure-3.3.4.jar:3.3.4]
    at org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper.lambda$asClientRegistrations$0(OAuth2ClientPropertiesMapper.java:65) ~[spring-boot-autoconfigure-3.3.4.jar:3.3.4]
    at java.base/java.util.HashMap.forEach(HashMap.java:1429) ~[na:na]
    at org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientPropertiesMapper.asClientRegistrations(OAuth2ClientPropertiesMapper.java:64) ~[spring-boot-autoconfigure-3.3.4.jar:3.3.4]
    at org.springframework.boot.autoconfigure.security.oauth2.client.servlet.OAuth2ClientRegistrationRepositoryConfiguration.clientRegistrationRepository(OAuth2ClientRegistrationRepositoryConfiguration.java:49) ~[spring-boot-autoconfigure-3.3.4.jar:3.3.4]
    at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103) ~[na:na]
    at java.base/java.lang.reflect.Method.invoke(Method.java:580) ~[na:na]
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:146) ~[spring-beans-6.1.13.jar:6.1.13]
    ... 73 common frames omitted

已完成的排查 #

• 确认Client ID、客户端密钥与Azure门户配置一致
• 确认重定向URI已在Azure门户中注册
• 浏览器直接访问Issuer URI能获取到有效的OpenID配置JSON

排查建议 #

1. 拆分Issuer URI与策略参数 #

Azure AD B2C的OpenID配置返回的issuer字段是不带策略参数（p=B2C_1_signupsignin）的基础路径，而Spring Security自动发现时会验证配置的Issuer URI与返回的issuer是否完全匹配。尝试手动配置各个端点，将Issuer URI改为基础路径：

spring.security.oauth2.client.provider.azure.issuer-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/v2.0/
spring.security.oauth2.client.provider.azure.authorization-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/oauth2/v2.0/authorize?p=B2C_1_signupsignin
spring.security.oauth2.client.provider.azure.token-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/oauth2/v2.0/token?p=B2C_1_signupsignin
spring.security.oauth2.client.provider.azure.jwk-set-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/discovery/v2.0/keys?p=B2C_1_signupsignin
spring.security.oauth2.client.provider.azure.user-info-uri=https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/openid/v2.0/userinfo?p=B2C_1_signupsignin

2. 检查Spring Security的Issuer验证逻辑 #

Spring Security OAuth2客户端在自动发现配置时，会严格校验配置的Issuer URI和OpenID配置返回的issuer字段是否一致。如果返回的issuer是https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/v2.0/，而你配置的是带查询参数的URI，就会导致验证失败。

3. 临时禁用Issuer验证（仅限排查） #

若要快速确认是否为Issuer匹配问题，可以临时关闭Issuer验证（生产环境不建议）。修改SecurityConfig，手动指定授权请求的Issuer属性：

@Bean
public OAuth2AuthorizationRequestResolver authorizationRequestResolver(ClientRegistrationRepository clientRegistrationRepository) {
    DefaultOAuth2AuthorizationRequestResolver resolver = new DefaultOAuth2AuthorizationRequestResolver(clientRegistrationRepository, "/oauth2/authorize");
    resolver.setAuthorizationRequestCustomizer(customizer -> customizer.attributes(attrs -> {
        attrs.put(OAuth2ParameterNames.ISS, "https://learningakash.b2clogin.com/learningakash.onmicrosoft.com/v2.0/");
    }));
    return resolver;
}

4. 验证应用服务器的网络访问能力 #

浏览器能访问不代表应用服务器能访问，检查服务器是否有代理、防火墙限制。可以在应用中添加测试代码，直接发起HTTP请求到Issuer URI，确认应用能正常获取响应。

内容的提问来源于stack exchange，提问作者Akash Verma