{"record":{"id":"51e1e60e59a581e9","repo":"quarkusio/quarkus","slug":"when-using-a-key-store-the-quarkus-oidc-client-c","errorCode":null,"errorMessage":"When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set","messagePattern":"When using a key store, the `quarkus\\.oidc-client\\.credentials\\.jwt\\.key-password` property must be set","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":534,"sourceCode":"                            getSignatureAlgorithm(creds, SignatureAlgorithm.RS256));\n                } else if (creds.jwt().keyFile().isPresent()) {\n                    key = KeyUtils.readSigningKey(creds.jwt().keyFile().get(), creds.jwt().keyId().orElse(null),\n                            getSignatureAlgorithm(creds, SignatureAlgorithm.RS256));\n                } else if (creds.jwt().keyStoreFile().isPresent()) {\n                    var keyStoreFile = creds.jwt().keyStoreFile().get();\n                    KeyStore ks = KeyStore.getInstance(inferKeyStoreTypeFromFileExtension(keyStoreFile));\n                    InputStream is = ResourceUtils.getResourceStream(keyStoreFile);\n\n                    if (creds.jwt().keyStorePassword().isPresent()) {\n                        ks.load(is, creds.jwt().keyStorePassword().get().toCharArray());\n                    } else {\n                        ks.load(is, null);\n                    }\n\n                    if (creds.jwt().keyPassword().isPresent()) {\n                        key = ks.getKey(creds.jwt().keyId().get(), creds.jwt().keyPassword().get().toCharArray());\n                    } else {\n                        throw new ConfigurationException(\n                                \"When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set\");\n                    }\n                }\n            } catch (Exception ex) {\n                throw new ConfigurationException(\"Key can not be loaded\", ex);\n            }\n            if (key == null) {\n                throw new ConfigurationException(\"Key is null\");\n            }\n            return Uni.createFrom().item(key);\n        }\n    }\n\n    public static String signJwtWithKey(OidcClientCommonConfig oidcConfig, String tokenRequestUri, Key key) {\n        // 'jti' and 'iat' claims are created by default, 'iat' - is set to the current time\n        JwtSignatureBuilder jwtSignatureBuilder = Jwt\n                .claims(additionalClaims(oidcConfig.credentials().jwt().claims()))\n                .issuer(oidcConfig.credentials().jwt().issuer().orElse(oidcConfig.clientId().get()))","sourceCodeStart":516,"sourceCodeEnd":552,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L516-L552","documentation":"When JWT client credentials are loaded from a Java key store, each stored key is protected by a separate key password distinct from the store password. Quarkus requires quarkus.oidc-client.credentials.jwt.key-password to retrieve the PrivateKey; without it a ConfigurationException is thrown.","triggerScenarios":"quarkus.oidc-client.credentials.jwt.key-store-file is set (key store loaded successfully) but credentials.jwt.key-password is absent when clientJwtKey calls ks.getKey(...) via initClientJwtKey.","commonSituations":"Setting the key store path and store password but forgetting the per-entry key password; assuming key password equals store password and omitting it.","solutions":["Set quarkus.oidc-client.credentials.jwt.key-password=<entry key password>","If the key entry password equals the store password, still set key-password explicitly to that value","Alternatively, avoid a key store: load the key from a PEM key file via credentials.jwt.key-file instead"],"exampleFix":"// before\nquarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks\nquarkus.oidc-client.credentials.jwt.key-store-password=storepass\n// after\nquarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks\nquarkus.oidc-client.credentials.jwt.key-store-password=storepass\nquarkus.oidc-client.credentials.jwt.key-password=keypass","handlingStrategy":"validation","validationCode":"if (ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.key-store-file\", String.class).isPresent()\n    && ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc-client.credentials.jwt.key-password\", String.class).isEmpty()) {\n    throw new IllegalStateException(\"key-store-file set but credentials.jwt.key-password missing\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set key-password alongside key-store-file","Store both passwords in the same secret store/config profile","Document key store creation parameters (store vs key password) for your team"],"tags":["config","oidc","keystore","jwt"],"backgroundTag":"missing-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}