{"record":{"id":"0e7dba2e0ae64f5e","repo":"quarkusio/quarkus","slug":"unsupported-jwt-source-source","errorCode":null,"errorMessage":"Unsupported JWT source: <source>","messagePattern":"Unsupported JWT source: <source>","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java","lineNumber":43,"sourceCode":"    private static final Logger LOG = Logger.getLogger(KubernetesServiceClientAssertionProvider.class);\n    private static final String SPIFFE_ID_SCHEME = \"spiffe://\";\n    private final Vertx vertx;\n    private final Path tokenPath;\n    private final String clientAssertionType;\n    private final String tokenType;\n    volatile ClientAssertion clientAssertion;\n\n    KubernetesServiceClientAssertionProvider(Vertx vertx, Path tokenPath, Source source) {\n        this.vertx = vertx;\n        this.tokenPath = tokenPath;\n        if (source == Source.BEARER) {\n            this.clientAssertionType = OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE;\n            this.tokenType = \"JWT bearer\";\n        } else if (source == Source.SPIFFE_JWT) {\n            this.clientAssertionType = OidcConstants.SPIFFE_SVID_CLIENT_ASSERTION_TYPE;\n            this.tokenType = \"SPIFFE JWT-SVID\";\n        } else {\n            throw new IllegalStateException(\"Unsupported JWT source: \" + source);\n        }\n        this.clientAssertion = loadInitialClientAssertion();\n    }\n\n    @Override\n    public Uni<String> getClientAssertion() {\n        return Uni.createFrom().item(this::getAvailableClientAssertion);\n    }\n\n    String getAvailableClientAssertion() {\n        ClientAssertion clientAssertion = this.clientAssertion;\n        if (isInvalid(clientAssertion)) {\n            clientAssertion = loadClientAssertion();\n        }\n        return clientAssertion == null ? null : clientAssertion.bearerToken;\n    }\n\n    @Override","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java#L25-L61","documentation":"KubernetesServiceClientAssertionProvider supports only a fixed set of JWT assertion sources (e.g. Kubernetes service-account token, SPIFFE JWT-SVID). Its constructor switches on the Source enum and throws IllegalStateException for any Source value it does not handle, indicating an internal configuration/mapping gap rather than a user input problem.","triggerScenarios":"Constructing KubernetesServiceClientAssertionProvider with a Source enum value outside the handled branches (Kubernetes JWT / SPIFFE_JWT), typically when a new source kind is configured but the provider lacks a branch for it.","commonSituations":"Newer Quarkus configuration options introducing additional assertion sources with a mismatched/missing branch; internal misconfiguration of the JWT-bearer client assertion source for Kubernetes authentication.","solutions":["Check your quarkus.oidc-client credentials.jwt configuration and use a supported assertion source (kubernetes service account token or SPIFFE SVID)","Upgrade Quarkus to a version where the configured source is supported","If you added a custom Source constant, add the corresponding branch mapping clientAssertionType/tokenType"],"exampleFix":"// before\njwt.source = custom-source // unsupported\n// after\njwt.source = kubernetes-service-account-token (or spiffe) // supported sources only","handlingStrategy":"validation","validationCode":"if (source != Source.KUBERNETES_JWT && source != Source.SPIFFE_JWT) {\n    throw new IllegalArgumentException(\"Unsupported JWT source: \" + source);\n}","typeGuard":"boolean isSupportedSource(Source s) {\n    return s == Source.KUBERNETES_JWT || s == Source.SPIFFE_JWT;\n}","tryCatchPattern":"try {\n    var provider = new KubernetesServiceClientAssertionProvider(source, ...);\n} catch (IllegalStateException e) {\n    LOG.error(\"Falling back to default client assertion: \" + e.getMessage());\n}","preventionTips":["Configure only the documented JWT assertion sources","Keep Quarkus and any custom Source enum usage in sync","Log the configured source at startup to catch bad values early"],"tags":["oidc","kubernetes","illegal-state","jwt"],"backgroundTag":"unsupported-assertion-source","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}