OAuth 2.0 Authorization Errors

The following information describes the errors that can occur during OAuth 2.0 authorization.

OAuth 2.0 Authorization Errors describes the OAuth 2.0 authorization errors.
Table 1. OAuth 2.0 Authorization Errors
ERROR DESCRIPTION
Internal Server Error Returns a 500 error code. This error occurs when the issuer cannot be reached. The log includes the following: 
org.springframework.security.oauth2.jwt.JwtDecoderInitializationException: Failed to lazily resolve the supplied JwtDecoder instance.
invalid_request The request is missing a required parameter, includes an invalid parameter value, or is otherwise malformed. One of the following errors.
  • HTTPS is required.
  • HTTP GET is required.
  • HTTP POST is required.
  • The code_challenge value was invalid, such as not being base64 encoded.
  • Flow does not support and did not expect a code_challenge parameter.
  • Out-of-band is not supported.
  • The JSON Web Token (JWT) bearer and SAML assertion bearer flows require a refresh_token scope. Install and preauthorize the app.
  • For the device flow, the device code specified in the polling request is invalid.
  • For the username-password flow, the scope parameter isn’t supported.
  • For the refresh token flow, the secret type is not supported.
invalid_scope The requested scope is invalid, unknown, or malformed.
invalid_token Occurs in the following situations with the indicated message:
  • When the JWT token was encoded with a key that the issuer is not currently using: "An error occurred while attempting to decode the JWT: Signed JWT rejected: Another algorithm expected, or no matching key(s) found."
  • The JWT token is expired: "An error occurred while attempting to decode the JWT: JWT expired at <timestamp>."
  • The JWT token is malformed: "An error occurred while attempting to decode the JWT: Malformed payload."

In all cases, the issuer can be reached but the token is bad.
server_error The authorization server encountered an unexpected condition which prevented it from fulfilling the request.
temporarily_unavailable The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server.
unauthorized_client The client is not authorized to request an authorization code using this method.
unsupported_response_type The authorization server does not support obtaining an authorization code using this method.