{"record":{"id":"22f3497d9ba35315","repo":"quarkusio/quarkus","slug":"configuration-property-quarkus-rest-client-oidc-t","errorCode":null,"errorMessage":"Configuration property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to 'true', however this configuration property is only supported when either 'quarkus-oidc' or 'quarkus-smallrye-jwt' extensions are present.","messagePattern":"Configuration property 'quarkus\\.rest-client-oidc-token-propagation\\.enabled-during-authentication' is set to 'true', however this configuration property is only supported when either 'quarkus-oidc' or 'quarkus-smallrye-jwt' extensions are present\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-token-propagation-reactive/deployment/src/main/java/io/quarkus/oidc/token/propagation/reactive/deployment/OidcTokenPropagationReactiveBuildStep.java","lineNumber":87,"sourceCode":"        additionalBeans.produce(AdditionalBeanBuildItem.unremovableOf(AccessTokenRequestReactiveFilter.class));\n        reflectiveClass.produce(ReflectiveClassBuildItem.builder(AccessTokenRequestReactiveFilter.class.getName())\n                .reason(getClass().getName())\n                .methods().fields().build());\n        additionalIndexedClassesBuildItem\n                .produce(new AdditionalIndexedClassesBuildItem(AccessTokenRequestReactiveFilter.class.getName()));\n    }\n\n    @BuildStep(onlyIf = IsEnabledDuringAuth.class)\n    SystemPropertyBuildItem activateTokenCredentialPropagationViaDuplicatedContext(Capabilities capabilities) {\n        if (capabilities.isPresent(Capability.OIDC)) {\n            return new SystemPropertyBuildItem(OIDC_PROPAGATE_TOKEN_CREDENTIAL, \"true\");\n        }\n\n        if (capabilities.isPresent(Capability.JWT)) {\n            return new SystemPropertyBuildItem(JWT_PROPAGATE_TOKEN_CREDENTIAL, \"true\");\n        }\n\n        throw new ConfigurationException(\n                \"Configuration property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to \" +\n                        \"'true', however this configuration property is only supported when either 'quarkus-oidc' or \" +\n                        \"'quarkus-smallrye-jwt' extensions are present.\");\n    }\n\n    public static class IsEnabled implements BooleanSupplier {\n        OidcTokenPropagationReactiveBuildTimeConfig config;\n\n        public boolean getAsBoolean() {\n            return config.enabled();\n        }\n    }\n\n    public static class IsEnabledDuringAuth implements BooleanSupplier {\n        OidcTokenPropagationReactiveBuildTimeConfig config;\n\n        public boolean getAsBoolean() {\n            return config.enabledDuringAuthentication();","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-token-propagation-reactive/deployment/src/main/java/io/quarkus/oidc/token/propagation/reactive/deployment/OidcTokenPropagationReactiveBuildStep.java#L69-L105","documentation":"This build-time error is thrown by the reactive OIDC token propagation extension when the property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to true, but neither 'quarkus-oidc' nor 'quarkus-smallrye-jwt' is on the classpath. Token propagation works by wiring a TokenCredential produced during authentication into the duplicated context; without one of those authentication extensions there is nothing producing that credential, so the configuration is invalid and the build fails fast via a ConfigurationException.","triggerScenarios":"An application sets quarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true (or defaults it via java.security.Principal injection support) in application.properties while only having quarkus-rest-client-* and quarkus-oidc-token-propagation-reactive dependencies, with no OIDC or smallrye-jwt extension present. Thrown from activateTokenCredentialPropagationViaDuplicatedContext during static init of the build.","commonSituations":"Copying a REST client configuration from a project that also used quarkus-oidc; removing quarkus-oidc during a refactor but keeping token propagation config; relying on plain Keycloak/RestClient without adding the auth extension; upgrading and the OIDC dependency was dropped from the BOM.","solutions":["Add 'quarkus-oidc' (or 'quarkus-smallrye-jwt') as a dependency so tokens are actually produced during authentication","If you do not authenticate requests, remove quarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true from configuration","Use quarkus.rest-client-oidc-token-propagation instead (propagate the current access token directly) if that matches your intent"],"exampleFix":"// before (pom.xml lacks auth extension, application.properties)\nquarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true\n// after (pom.xml)\n<dependency>\n  <groupId>io.quarkus</groupId>\n  <artifactId>quarkus-oidc</artifactId>\n</dependency>","handlingStrategy":"validation","validationCode":"boolean enabled = ConfigProvider.getConfig()\n    .getOptionalValue(\"quarkus.rest-client-oidc-token-propagation.enabled-during-authentication\", Boolean.class)\n    .orElse(false);\nif (enabled) {\n    Class.forName(\"io.quarkus.oidc.Oidc\", false, Thread.currentThread().getContextClassLoader());\n    // or check for io.smallrye.jwt.* if using quarkus-smallrye-jwt\n}","typeGuard":null,"tryCatchPattern":"try {\n    startApp();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"enabled-during-authentication\")) {\n        throw new IllegalStateException(\"Add quarkus-oidc or quarkus-smallrye-jwt, or disable token propagation\", e);\n    }\n    throw e;\n}","preventionTips":["Only set enabled-during-authentication=true in profiles that include an authentication extension","Add quarkus-oidc/quarkus-smallrye-jwt to the same module as your REST client config","Run a JVM-mode dev build before native packaging to catch build-time config errors early"],"tags":["quarkus","configuration","oidc","build-time"],"backgroundTag":"missing-extension-dependency","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}