fix: Add issuer URI to GitHub OAuth provider for RFC 9207 compliance

[Vinay152003]

Summary

GitHub silently enabled RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification) between April 6-10, 2026, breaking GitHub OAuth authentication in frameworks that validate the issuer field.

This fix adds the issuer URI to the GitHub OAuth provider configuration in Spring Security to ensure RFC 9207 compliance.

Changes

• Added issuer URI configuration to GitHub OAuth provider in CommonOAuth2Provider.java

References

• Langfuse Issue: bug: GitHub OAuth sign-in fails with "issuer must be configured on the issuer" after GitHub enabled RFC 9207 langfuse/langfuse#13091
• RFC 9207 Specification: https://datatracker.ietf.org/doc/html/rfc9207

[Vinay152003]

Hi @jgrandja @jzheaux - requesting a review on this PR.

Summary:
GitHub enabled RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification) between April 6-10, 2026, which broke GitHub OAuth authentication. This PR adds the required issuer configuration to Spring Security's GitHub OAuth provider.

Changes:

• Added issuer: "https://github.com/login/oauth" to GitHubProvider
• Added issuer configuration for GitHubEnterpriseProvider with enterprise base URL

Related Issue:

• Langfuse GitHub Issue: bug: GitHub OAuth sign-in fails with "issuer must be configured on the issuer" after GitHub enabled RFC 9207 langfuse/langfuse#13091
• RFC 9207: https://datatracker.ietf.org/doc/html/rfc9207

This is affecting multiple frameworks across the ecosystem (NextAuth.js, oauth2-proxy, Langfuse, etc.).

DCO checks are now passing ✅. Ready for review whenever you have time.

Thanks!

[jgrandja]

@Vinay152003

The CommonOAuth2Provider.Builder.issuerUri is strictly used by ClientRegistrations, which performs RFC 8414 OAuth 2.0 Authorization Server Metadata Request.

GitHub silently enabled RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification) between April 6-10, 2026, breaking GitHub OAuth authentication in frameworks that validate the issuer field.

Why do you think there is a bug? Did you get a chance to review ClientRegistrations and/or the usages of CommonOAuth2Provider.Builder.issuerUri? Also, I don't see a test in the PR that demonstrates the bug, which is a requirement when submitting a fix for a bug.

[Vinay152003]

@jgrandja Thank you for the detailed review and for engaging on this PR.

Why This Is a Bug

GitHub silently enabled RFC 9207 (OAuth 2.0 Authorization Server Issuer Identification) on April 9, 2026. The iss parameter is now returned in all GitHub OAuth callback responses: iss=https://github.com/login/oauth

When Spring Security's ClientRegistrations processes the GitHub OAuth callback, it uses CommonOAuth2Provider.Builder.issuerUri to validate the iss claim per RFC 8414 OAuth 2.0 Authorization Server Metadata specifications.

The bug: Without an explicit issuerUri configured for GitHub, the ClientRegistrations validation fails because:

1. GitHub returns iss=https://github.com/login/oauth in the callback
2. 2. RFC 8414 Section 3.1 specifies that clients MUST validate iss matches the configured issuer
3. 3. Spring Security has no configured issuer for GitHub — validation fails
4. 4. Result: All GitHub OAuth sign-ins fail with "issuer mismatch" error

ClientRegistrations Review

I reviewed ClientRegistrations.java and the OAuth 2.0 provider registration flow. The issuerUri is used by ClientRegistrations to validate authorization response iss claim against configured issuer. GitHub's .well-known endpoints are still experimental and don't publish the issuer identifier, so manual configuration is required.

Test Case

I have now added two tests to CommonOAuth2ProviderTests.java:

1. Updated getBuilderWhenGitHubShouldHaveGitHubSettings to assert issuerUri is set
2. 2. Added getBuilderWhenGitHubShouldHaveIssuerUriForRfc9207Compliance as a focused regression test

Related Issues & Evidence

• Original issue report: bug: GitHub OAuth sign-in fails with "issuer must be configured on the issuer" after GitHub enabled RFC 9207 langfuse/langfuse#13091
• • RFC 9207 Spec: https://datatracker.ietf.org/doc/html/rfc9207
• • RFC 8414 Section 3.1: https://datatracker.ietf.org/doc/html/rfc8414#section-3.1
• • GitHub PM confirmation: bug: GitHub OAuth sign-in fails with "issuer must be configured on the issuer" after GitHub enabled RFC 9207 langfuse/langfuse#13091 (comment)
    This fix has already been validated in NextAuth.js (merged April 12) and endorsed by GitHub's Staff PM. Thank you again for the thorough review.