如何修复连接Amazon Cognito用户池时application.yml的Converter Error？

搭建了一个部署在Elastic Beanstalk上的Web应用，集成Amazon Cognito用户池与Hosted UI实现登录授权，用户需登录后才能访问表单页面。已配置自定义域名和SSL证书保障登录安全，但启动时出现Spring OAuth2属性绑定错误：

Failed to bind properties under 'spring.security.oauth2.client.registration.clientsecret' to org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties$Registration:
    Reason: No converter found capable of converting from type [java.lang.String] to type [org.springframework.boot.autoconfigure.security.oauth2.client.OAuth2ClientProperties$Registration]

当前使用的application.yml配置如下：

spring:
  security:
    oauth2:
      client:
        registration:
          cognito:
          clientId: 47earg9gbo****
          clientSecret: bbvgpirvegmnr4gp4sunmp****
          scope: openid, email, aws.cognito.signin.user.admin, phone
          redirectUriTemplate: https://authorise.student.co.uk
          clientName: spring-boot
    provider:
      cognito:
        issuerUri: https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_BnR5***

已尝试重建Cognito用户池、更新pom.xml，当前pom.xml内容：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>StudentCognito</groupId>
    <artifactId>StudentCognito</artifactId>
    <version>1.0-SNAPSHOT</version>
    <packaging>jar</packaging>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.3.0.RELEASE</version>
        <relativePath/>
    </parent>
    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <java.version>1.8</java.version>
    </properties>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>software.amazon.awssdk</groupId>
                <artifactId>bom</artifactId>
                <version>2.16.29</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <dependencies>
        <!--CORE-->
        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>dynamodb-enhanced</artifactId>
            <version>2.11.0-PREVIEW</version>
        </dependency>
        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>dynamodb</artifactId>
        </dependency>
        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>sns</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-client</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity5</artifactId>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <version>${project.parent.version}</version>
            </plugin>
        </plugins>
    </build>
</project>

1. 修正YAML缩进错误（核心问题） #

错误根源是application.yml中cognito:节点的缩进问题：当前clientId、clientSecret等属性直接挂在registration节点下，而非cognito子节点下，导致Spring将clientSecret解析为registration的属性，类型不匹配。

修正后的application.yml：

spring:
  security:
    oauth2:
      client:
        registration:
          cognito:
            clientId: 47earg9gbo****
            clientSecret: bbvgpirvegmnr4gp4sunmp****
            scope: openid, email, aws.cognito.signin.user.admin, phone
            redirectUriTemplate: "{baseUrl}/login/oauth2/code/{registrationId}"
            clientName: spring-boot
        provider:
          cognito:
            issuerUri: https://cognito-idp.eu-west-2.amazonaws.com/eu-west-2_BnR5***

注意：

• cognito:下的所有属性需缩进一级，作为cognito的子属性
• redirectUriTemplate建议使用Spring OAuth2默认格式{baseUrl}/login/oauth2/code/{registrationId}，确保Cognito回调能正确匹配；若使用自定义域名，需保证该路径在域名下可访问，且已在Cognito用户池的应用客户端设置中添加该回调URL

2. 优化依赖版本兼容性 #

当前使用Spring Boot 2.3.0.RELEASE，对应的spring-boot-starter-oauth2-client版本与AWS SDK版本无明显冲突，但建议将dynamodb-enhanced的预览版替换为与bom一致的正式版，避免潜在问题：

<dependency>
    <groupId>software.amazon.awssdk</groupId>
    <artifactId>dynamodb-enhanced</artifactId>
    <!-- 移除固定预览版，使用bom中的统一版本 -->
</dependency>

3. 确认Cognito配置匹配 #

• 确保Cognito用户池的应用客户端ID与clientId完全一致
• clientSecret需与Cognito应用客户端生成的密钥一致
• issuerUri中的用户池ID（eu-west-2_BnR5***部分）需正确
• 已在Cognito应用客户端的回调URL中添加redirectUriTemplate指定的地址

内容的提问来源于stack exchange，提问作者Arkadiusz