SpringBoot集成AWS Cognito报错：无法解析issuerUri问题排查

尝试搭建基于AWS Cognito实现授权功能的Spring Boot示例应用，按照多篇教程操作后始终触发同一异常，启动应用时抛出如下错误：

org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration': Unsatisfied dependency expressed through field 'httpSecurity': Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.HttpSecurityConfiguration': Unsatisfied dependency expressed through method 'setContentNegotiationStrategy' parameter 0: Error creating bean with name 'org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration$EnableWebMvcConfiguration': Unsatisfied dependency expressed through method 'setConfigurers' parameter 0: Error creating bean with name 'org.springframework.security.config.annotation.web.configuration.OAuth2ClientConfiguration$OAuth2ClientWebMvcSecurityConfiguration': Unsatisfied dependency expressed through method 'setAuthorizedClientManager' parameter 0: Error creating bean with name 'OAuth2AuthorizedClientManager': Failed to instantiate [org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager]: Factory method 'getAuthorizedClientManager' threw exception with message: Error creating bean with name 'clientRegistrationRepository' defined in class path resource [org/springframework/boot/autoconfigure/security/oauth2/client/servlet/OAuth2ClientRegistrationRepositoryConfiguration.class]:Failed to instantiate [org.springframework.security.oauth2.client.registration.InMemoryClientRegistrationRepository]: Factory method 'clientRegistrationRepository' threw exception with message: Unable to resolve Configuration with the provided Issuer of "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_9EmaXexYM/.well-known/openid-configuration"

直接在浏览器中访问该配置URL能正常获取完整的OpenID配置信息，但应用启动时却无法解析。

当前使用的application.yml配置如下：

spring:
  security:
    oauth2:
      client:
        registration:
          cognito:
            clientName: SpringBootApp
            client-secret: 11iflp3rhfuj9veomalbsvoi5url4vhu3r39in5l1jo0btsac48s
            redirect-uri: 'http://localhost:8080/login/oauth2/code/cognito'
            client-id: 3ai0tn07c5smcn00d963670rsf
            scope: openid
            authorization-grant-type: authorization_code
        provider:
          cognito:
            issuerUri: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_9EmaXexYM/.well-known/openid-configuration

问题原因及解决方案 #

核心问题：IssuerUri配置错误 #

Spring Security OAuth2要求issuerUri配置的是身份提供者的基础颁发者URL，而非直接指向OpenID配置文件的完整路径。框架会自动在基础URL后拼接.well-known/openid-configuration来获取配置信息。当前配置把完整的配置文件URL作为issuerUri，导致框架无法正确识别颁发者信息，进而无法解析配置。

修复步骤 #

修改application.yml中provider.cognito.issuerUri的值，移除末尾的.well-known/openid-configuration：

spring:
  security:
    oauth2:
      client:
        registration:
          cognito:
            clientName: SpringBootApp
            client-secret: 11iflp3rhfuj9veomalbsvoi5url4vhu3r39in5l1jo0btsac48s
            redirect-uri: 'http://localhost:8080/login/oauth2/code/cognito'
            client-id: 3ai0tn07c5smcn00d963670rsf
            scope: openid
            authorization-grant-type: authorization_code
        provider:
          cognito:
            issuerUri: https://cognito-idp.us-east-1.amazonaws.com/us-east-1_9EmaXexYM

额外检查项 #

• 确认Spring Boot与Spring Security版本兼容（例如Spring Boot 2.7.x搭配Spring Security 5.7+，Spring Boot 3.x搭配Spring Security 6.x）
• 检查应用服务器是否能正常访问AWS Cognito的端点（无代理拦截、防火墙限制）
• 验证Cognito用户池客户端配置：允许的回调URL包含http://localhost:8080/login/oauth2/code/cognito，客户端密钥正确，已启用authorization_code授权类型

内容的提问来源于stack exchange，提问作者Martin Dvoracek