{"record":{"id":"2891ae5e4b4f8664","repo":"quarkusio/quarkus","slug":"client-id-client-secret-and-introspection-url-mus","errorCode":null,"errorMessage":"client-id, client-secret and introspection-url must be configured when the oauth2 extension is enabled","messagePattern":"client-id, client-secret and introspection-url must be configured when the oauth2 extension is enabled","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/elytron-security-oauth2/runtime/src/main/java/io/quarkus/elytron/security/oauth2/runtime/OAuth2Recorder.java","lineNumber":45,"sourceCode":"import io.quarkus.runtime.RuntimeValue;\nimport io.quarkus.runtime.annotations.Recorder;\nimport io.quarkus.runtime.configuration.ConfigurationException;\n\n@Recorder\npublic class OAuth2Recorder {\n    private final RuntimeValue<OAuth2RuntimeConfig> runtimeConfig;\n\n    public OAuth2Recorder(final RuntimeValue<OAuth2RuntimeConfig> runtimeConfig) {\n        this.runtimeConfig = runtimeConfig;\n    }\n\n    public RuntimeValue<SecurityRealm> createRealm()\n            throws IOException, NoSuchAlgorithmException, CertificateException, KeyStoreException, KeyManagementException {\n        OAuth2RuntimeConfig runtimeConfig = this.runtimeConfig.getValue();\n\n        if (!runtimeConfig.clientId().isPresent() || !runtimeConfig.clientSecret().isPresent()\n                || !runtimeConfig.introspectionUrl().isPresent()) {\n            throw new ConfigurationException(\n                    \"client-id, client-secret and introspection-url must be configured when the oauth2 extension is enabled\");\n        }\n\n        OAuth2IntrospectValidator.Builder validatorBuilder = OAuth2IntrospectValidator.builder()\n                .clientId(runtimeConfig.clientId().get())\n                .clientSecret(runtimeConfig.clientSecret().get())\n                .tokenIntrospectionUrl(URI.create(runtimeConfig.introspectionUrl().get()).toURL());\n\n        if (runtimeConfig.caCertFile().isPresent()) {\n            validatorBuilder.useSslContext(createSSLContext(runtimeConfig));\n        } else {\n            validatorBuilder.useSslContext(SSLContext.getDefault());\n        }\n\n        if (runtimeConfig.connectionTimeout().isPresent()) {\n            validatorBuilder.connectionTimeout((int) runtimeConfig.connectionTimeout().get().toMillis());\n        }\n","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/elytron-security-oauth2/runtime/src/main/java/io/quarkus/elytron/security/oauth2/runtime/OAuth2Recorder.java#L27-L63","documentation":"The elytron-security-oauth2 extension validates tokens via an OAuth2 introspection endpoint. At static-init/build of the security realm, the recorder checks runtime config; if client-id, client-secret or introspection-url is missing it cannot build the introspection validator and throws a ConfigurationException.","triggerScenarios":"quarkus.elytron.security.oauth2 extension is on the classpath but quarkus.elytron.security.oauth2.client-id, client-secret, or introspection-url is not set (or not resolvable from env vars/profiles).","commonSituations":"Added the extension but forgot config; config keys spelled wrong; secrets missing in the deployment environment; relying on a config profile that is not active.","solutions":["Set quarkus.elytron.security.oauth2.client-id, client-secret and introspection-url in application.properties or via environment variables","Remove the quarkus-elytron-security-oauth2 dependency if OAuth2 token validation is not actually used","Verify the active Quarkus profile resolves these properties (e.g. %prod prefix not applied in dev)"],"exampleFix":"// before (application.properties)\nquarkus.elytron.security.oauth2.enabled=true\n// after\nquarkus.elytron.security.oauth2.enabled=true\nquarkus.elytron.security.oauth2.client-id=my-client\nquarkus.elytron.security.oauth2.client-secret=s3cr3t\nquarkus.elytron.security.oauth2.introspection-url=https://idp.example.com/introspect","handlingStrategy":"validation","validationCode":"if (!config.containsProperty(\"quarkus.elytron.security.oauth2.client-id\") ||\n    !config.containsProperty(\"quarkus.elytron.security.oauth2.client-secret\") ||\n    !config.containsProperty(\"quarkus.elytron.security.oauth2.introspection-url\")) {\n    throw new IllegalStateException(\"oauth2 realm requires client-id, client-secret and introspection-url\");\n}","typeGuard":null,"tryCatchPattern":"try { /* app start */ } catch (ConfigurationException e) {\n    log.error(\"oauth2 config incomplete: \" + e.getMessage());\n    throw e;\n}","preventionTips":["Define all three oauth2 properties in application.properties before adding the extension","Use env vars consistently for secrets across environments","Fail fast with a startup config test in CI"],"tags":["oauth2","configuration","security","missing-config"],"backgroundTag":"missing-required-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}