# Spring security oidc oath2 Okta login invalid user response

**URL:** <https://devforum.okta.com/t/spring-security-oidc-oath2-okta-login-invalid-user-response/27187>\
**Category:** OAuth/OIDC\
**Tags:** spring\
**Created:** [March 8, 2024, 3:23pm UTC](https://devforum.okta.com/t/spring-security-oidc-oath2-okta-login-invalid-user-response/27187 "2024-03-08T15:23:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![faisalloe](https://avatars.discourse-cdn.com/v4/letter/f/8491ac/32.png) [@faisalloe](https://devforum.okta.com/u/faisalloe)\
**Post date:** [March 8, 2024, 3:23pm UTC](https://devforum.okta.com/t/spring-security-oidc-oath2-okta-login-invalid-user-response/27187/1 "2024-03-08T15:23:48Z")

</div>

I am following this example to secure application without springboot [secure-java-ee-rest-api](https://developer.okta.com/blog/2018/09/12/secure-java-ee-rest-api)

When I login to the [http://localhost:8080/myappContext/](http://localhost:8080/myappContext/) it takes me to Okta logic screen. I enter either one of the user in assign list and click “sign in” it signs in then shows following error.

any help is appreciated

 ![IMG_3831](https://global.discourse-cdn.com/oktadev/original/2X/3/3dcb5b9aeb7326d2d1a0b3d3fed90318fddf7d1a.jpeg)

**Following is my Okta application configuration**

I have Okta developer account application is setup as web application with oidc,

1. client authentication is “client secret”.
2. Grant type is (“Client credentials”, “authorization code”, implicit(hybrid) → allow id token with implicit grant type, allow access token with implicit grant type)
3. sign in direct uri is "[http://localhost:8080/myappContext/login/oauth2/code/okta](http://localhost:8080/myappContext/login/oauth2/code/okta)
4. signet redirect uri is “[http://localhost:8080/myappContext](http://localhost:8080/myappContext)”
5. login initiated by “App only”
6. Federation Broker Mode is disabled.
7. Okta api scopes granted none.
8. user assignments user1 and user 2 (2 users)
9. Groups: every one

**Following is my code detail**

```
Spring 5 security with OIDC login for Okta.
spring-framework version 5.3.x
spring security version 5.6.x

```

#SecurityWebApplicationInitializer.java#

```
public class SecurityWebApplicationInitializer
   extends AbstractSecurityWebApplicationInitializer {

   public SecurityWebApplicationInitializer() {
       super(SecurityConfiguration.class);
   }
}

```

#application.properties#

```
okta.client-id={clientId}
okta.client-secret={clientSecret}
okta.issuer-uri=https://{yourOktaDomain}/oauth2/default

```

#SecurityConfiguration.java#

```
@Configuration
@EnableWebSecurity
@PropertySource("classpath:application.properties")
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    private final String clientSecret;
    private final String clientId;
    private final String issuerUri;

    @Autowired
    public SecurityConfiguration(@Value("${okta.issuer-uri}") String issuerUri,
            @Value("${okta.client-id}") String clientId,
            @Value("${okta.client-secret}") String clientSecret) {
        this.issuerUri = issuerUri;
        this.clientId = clientId;
        this.clientSecret = clientSecret;
    }

@Override
   protected void configure(HttpSecurity http) throws Exception {
      http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
                .and()
           .authorizeRequests()
               .anyRequest().authenticated()
               .and()
           .oauth2Login();
   }

   @Bean
   public OAuth2AuthorizedClientService authorizedClientService() {
       return new InMemoryOAuth2AuthorizedClientService(clientRegistrationRepository());
   }

  

   @Bean
    public ClientRegistrationRepository clientRegistrationRepository() {
        ClientRegistration okta = getRegistration();
        return new InMemoryClientRegistrationRepository(okta);
    }

    public ClientRegistration getRegistration(){
    
      ClientRegistrations.fromOidcIssuerLocation(Objects.requireNonNull(issuerUri))
            .registrationId("okta")
            .clientId(clientId)
            .clientSecret(clientSecret)
            .build();
    }
}

```

#My controller#

```
public class SecureController{

@RequestMapping("/")
public String authenticated(Principal user){
   return "home";
}

@RequestMapping("/login/oauth2/code/okta")
public String callback(Principal user){
  retur "authenticated"
}
}

```

---

<div class="post-metadata">

**Author:** ![nikitag](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nikitag](https://devforum.okta.com/u/nikitag)\
**Post date:** [March 14, 2024, 9:26am UTC](https://devforum.okta.com/t/spring-security-oidc-oath2-okta-login-invalid-user-response/27187/2 "2024-03-14T09:26:03Z")

</div>

Hey @faisalloe

Could you check your Okta org’s system logs to see what additional details are logged for this issue?  
Log into Okta admin dashboard \>\> Reports \>\> System log

What is the behaviour if you run this in Postman? Okta Authentication API [Authentication | Okta Developer](https://developer.okta.com/docs/reference/api/authn/#get-started-with-authentication)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [April 13, 2024, 9:26am UTC](https://devforum.okta.com/t/spring-security-oidc-oath2-okta-login-invalid-user-response/27187/3 "2024-04-13T09:26:35Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.