When configuring a jwk public key file the alogrithm configuration is not used but always set to RS256.

See OAuth2ResourceServerJwtConfiguration.java#L78

Should be something like this:

@Bean
@Conditional(KeyValueCondition.class)
JwtDecoder jwtDecoderByPublicKeyValue() throws Exception {
    RSAPublicKey publicKey = (RSAPublicKey) KeyFactory.getInstance("RSA")
            .generatePublic(new X509EncodedKeySpec(getKeySpec(this.properties.readPublicKey())));
    return NimbusJwtDecoder.withPublicKey(publicKey).signatureAlgorithm(SignatureAlgorithm.from(this.properties.getJwsAlgorithm())).build();
}

Comment From: wilkinsona

Closing in favour of #20523.