{"record":{"id":"410f13ce60564a1b","repo":"quarkusio/quarkus","slug":"the-s-property-can-only-be-set-to-idtoken-for","errorCode":null,"errorMessage":"The '%s' property can only be set to 'idtoken' for WEB_APP application types","messagePattern":"The '(.+?)' property can only be set to 'idtoken' for WEB_APP application types","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":293,"sourceCode":"                                + \"' property can only be enabled for \"\n                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP\n                                + \" application types\");\n            }\n            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {\n                throw new ConfigurationException(\n                        \"The '\" + getConfigPropertyForTenant(tenantId, \"token.refresh-token-time-skew\")\n                                + \"' property can only be enabled for \"\n                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP\n                                + \" application types\");\n            }\n            if (oidcConfig.logout().path().isPresent()) {\n                throw new ConfigurationException(\n                        \"The '\" + getConfigPropertyForTenant(tenantId, \"logout.path\") + \"' property can only be enabled for \"\n                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP + \" application types\");\n            }\n            if (oidcConfig.roles().source().isPresent()\n                    && oidcConfig.roles().source().get() == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.idtoken) {\n                throw new ConfigurationException(\n                        \"The '\" + getConfigPropertyForTenant(tenantId, \"roles.source\")\n                                + \"' property can only be set to 'idtoken' for \"\n                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP\n                                + \" application types\");\n            }\n        } else {\n            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {\n                oidcConfig.token.setRefreshExpired(true);\n            }\n            if (oidcConfig.authentication().sessionAgeExtension().isPresent()\n                    && !oidcConfig.token().refreshExpired()) {\n                LOG.warn(\n                        \"Session age extension will not be effective because 'quarkus.oidc.token.refresh-expired=true' is not set\");\n            }\n            if (!oidcConfig.token().refreshExpired()\n                    && !oidcConfig.token().refreshTokenCacheTimeToLive().isZero()) {\n                throw new ConfigurationException(\n                        \"'\" + getConfigPropertyForTenant(tenantId, \"token.refresh-expired\")","sourceCodeStart":275,"sourceCodeEnd":311,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L275-L311","documentation":"Roles can be resolved from the ID token only in WEB_APP applications, because only web-app flows receive an ID token. Setting roles.source=idtoken for a service (bearer) application is invalid since bearer tokens are access tokens, so Quarkus throws this ConfigurationException at tenant creation.","triggerScenarios":"oidcConfig.roles().source() == Source.idtoken while applicationType != WEB_APP during createTenantContext.","commonSituations":"Configuring quarkus.oidc.roles.source=idtoken in an API secured with bearer access tokens; copying web-app role config into a service tenant; misunderstanding that access-token is the correct source for service apps.","solutions":["Set roles.source to accesstoken for service applications (roles read from the access token)","Remove roles.source and rely on the default for the application type","Change application-type to web-app if ID-token-based roles are intended"],"exampleFix":"// before\nquarkus.oidc.application-type=service\nquarkus.oidc.roles.source=idtoken\n// after\nquarkus.oidc.application-type=service\nquarkus.oidc.roles.source=accesstoken","handlingStrategy":"validation","validationCode":"if (!\"web-app\".equals(appType) && config.roles().source().orElse(null) == Roles.Source.idtoken) {\n    throw new IllegalArgumentException(\"roles.source=idtoken requires application-type=web-app\");\n}","typeGuard":"boolean usesIdTokenRoles(OidcTenantConfig c) {\n    return c.roles().source().orElse(null) == OidcTenantConfig.Roles.Source.idtoken;\n}","tryCatchPattern":null,"preventionTips":["Use roles.source=accesstoken for service apps","Document role source per tenant in config comments"],"tags":["quarkus","oidc","configuration","roles"],"backgroundTag":"oidc-web-app-only-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}