DocumentationExperience Cloud KCS

AEM as a Cloud Service OIDC authentication fails due to JWK set size limit

Last update: October 31, 2026

This article describes how to resolve OIDC authentication failures in Adobe Experience Manager as a Cloud Service when the remote JWK set exceeds the default input size limit.

Description description

Environment

  • Adobe Experience Manager as a Cloud Service (all versions)

Issue/Symptoms

  • OIDC authentication requests fail.
  • The following error appears in the logs:

ERROR org.apache.sling.auth.oauth_client.impl.OidcAuthenticationHandler Failed to validate token: Couldn’t retrieve remote JWK set: Exceeded configured input limit of 51200 bytes

  • The error persists even after updating configuration files, unless the correct JVM system property is applied.
  • The JWK set size from the identity provider is larger than 51,200 bytes (for example, approximately 58 KB).
  • The issue is reproducible in Dev, Stage, and Prod environments.

Cause

The default input size limit for remote JWK sets in the Nimbus DS library is 51,200 bytes. If the identity provider’s JWK set exceeds this limit, token validation fails unless the limit is increased via JVM system property and configuration.

Resolution resolution

To fix the OIDC authentication failure, follow these steps:

  1. Verify the size of the remote JWK set provided by the identity provider. If it exceeds 51,200 bytes, proceed to the next steps.
  2. Add or update the following JVM system property in the targeted Cloud environments: -Dnimbusds.jose.jwkset.maxSize=102400 (adjust the value if your JWK set is larger, up to a maximum of 10 MB).
  3. In the OidcAuthenticationHandler configuration, set the jwkSetHttpSizeLimit parameter to match the new size limit (for example, 102400).
  4. Deploy the updated configuration and JVM property to the relevant environments using the standard deployment pipeline.
  5. Ensure the deployment pipeline completes successfully and the new release is active.
  6. Test OIDC authentication to confirm that the error no longer occurs.
  7. Check the logs to verify that the JWK set is retrieved and processed without size limit errors.
recommendation-more-help
experience-cloud-kcs-help-kbarticles