{"record":{"id":"510278b06dc94ce6","repo":"quarkusio/quarkus","slug":"userinfo-is-not-required-for-oidc-tenant-s-but","errorCode":null,"errorMessage":"UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token","messagePattern":"UserInfo is not required for OIDC tenant '(.+?)' but it will be needed to verify a code flow access token","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":235,"sourceCode":"                    \"UserInfo is not required but UserInfo is expected to be the source of authorization roles\");\n        }\n        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)\n                && !enableUserInfo(oidcConfig)) {\n            String propertyName = getConfigPropertyForTenant(tenantId, \"token.verify-access-token-with-user-info\");\n            throw new ConfigurationException(\"UserInfo is not required but '%s' is enabled\".formatted(propertyName));\n        }\n        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)\n                && StepUpAuthenticationPolicy.isEnabled()) {\n            String propertyName = getConfigPropertyForTenant(tenantId, \"authentication.id-token-required\");\n            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not\n            // required for this tenant, which we cannot know\n            LOG.warnf(\"Step Up Authentication is not supported for tenant '%s', because the internal IdToken is\"\n                    + \" generated by Quarkus. Please see the '%s' configuration property documentation for more information\",\n                    tenantId, propertyName);\n        }\n        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)\n                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {\n            throw new ConfigurationException(\n                    \"UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token\"\n                            .formatted(tenantId));\n        }\n\n        if (!oidcConfig.discoveryEnabled().orElse(true)) {\n            if (!OidcUtils.isServiceApp(oidcConfig)) {\n                if (oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty()) {\n                    String authorizationPathProperty = getConfigPropertyForTenant(tenantId, \"authorization-path\");\n                    String tokenPathProperty = getConfigPropertyForTenant(tenantId, \"token-path\");\n                    throw new ConfigurationException(\n                            \"'web-app' applications must have '\" + authorizationPathProperty + \"' and '\" + tokenPathProperty\n                                    + \"' properties \"\n                                    + \"set when the discovery is disabled.\",\n                            Set.of(authorizationPathProperty, tokenPathProperty));\n                }\n            }\n            // JWK and introspection endpoints have to be set for both 'web-app' and 'service' applications\n            if (oidcConfig.jwksPath().isEmpty() && oidcConfig.introspectionPath().isEmpty()) {","sourceCodeStart":217,"sourceCodeEnd":253,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L217-L253","documentation":"A tenant can declare that no ID token is required (e.g. pure access-token flows). However, if code flow access tokens are configured to be verified with UserInfo, that verification still needs UserInfo — which in turn usually requires the ID token. createTenantContext throws this ConfigurationException when idTokenRequired=false, user-info not enabled, and verifyAccessTokenWithUserInfo=true, since the combination cannot work.","triggerScenarios":"createTenantContext sees oidcConfig.authentication().idTokenRequired() == false, enableUserInfo(oidcConfig) == false, and oidcConfig.token().verifyAccessTokenWithUserInfo() == true — e.g. quarkus.oidc.authentication.id-token-required=false together with quarkus.oidc.token.verify-access-token-with-user-info=true.","commonSituations":"Trying to accept only access tokens and disabling the ID token while leaving UserInfo-based access-token verification on; simplifying config to drop the ID token without noticing the token-verification dependency.","solutions":["Remove quarkus.oidc.token.verify-access-token-with-user-info=true, or verify the access token via JWKS/introspection instead.","Or re-enable the ID token (quarkus.oidc.authentication.id-token-required=true) so the code flow token chain works.","Or enable UserInfo properly (user-info-required=true) if UserInfo-dependent verification is genuinely intended."],"exampleFix":"// before\nquarkus.oidc.authentication.id-token-required=false\nquarkus.oidc.token.verify-access-token-with-user-info=true\n\n// after\nquarkus.oidc.authentication.id-token-required=false","handlingStrategy":"validation","validationCode":"boolean idTokenRequired = Optional.ofNullable(config.getProperty(\"quarkus.oidc.authentication.id-token-required\"))\n        .map(Boolean::parseBoolean).orElse(true);\nboolean verifyViaUserInfo = \"true\".equals(config.getProperty(\"quarkus.oidc.token.verify-access-token-with-user-info\"));\nif (!idTokenRequired && verifyViaUserInfo) {\n    throw new IllegalStateException(\"verify-access-token-with-user-info cannot be used with id-token-required=false\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When disabling the ID token, audit token.* options for UserInfo dependencies.","Prefer introspection or JWKS verification for access-token-only setups.","Document why id-token-required=false is set and what replaces ID-token-based verification."],"tags":["oidc","configuration","id-token","userinfo","startup"],"backgroundTag":"inconsistent-oidc-userinfo-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}