{"record":{"id":"531dcda0ff1a0dc4","repo":"quarkusio/quarkus","slug":"client-id-can-not-be-modified","errorCode":null,"errorMessage":"Client id can not be modified","messagePattern":"Client id can not be modified","errorType":"exception","errorClass":"OidcClientRegistrationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/runtime/RegisteredClientImpl.java","lineNumber":90,"sourceCode":"\n    @Override\n    public Uni<RegisteredClient> read() {\n        checkClosed();\n        checkClientRequestUri();\n        HttpRequest<Buffer> request = client.getAbs(registrationClientUri);\n        request.putHeader(HttpHeaders.ACCEPT.toString(), APPLICATION_JSON);\n        OidcRequestContextProperties requestProps = getRequestProps();\n        return makeRequest(requestProps, request, Buffer.buffer())\n                .transformToUni(resp -> newRegisteredClient(resp, requestProps));\n    }\n\n    @Override\n    public Uni<RegisteredClient> update(ClientMetadata newMetadata) {\n\n        checkClosed();\n        checkClientRequestUri();\n        if (newMetadata.getClientId() != null && !registeredMetadata.getClientId().equals(newMetadata.getClientId())) {\n            throw new OidcClientRegistrationException(\"Client id can not be modified\");\n        }\n        if (newMetadata.getClientSecret() != null\n                && !registeredMetadata.getClientSecret().equals(newMetadata.getClientSecret())) {\n            throw new OidcClientRegistrationException(\"Client secret can not be modified\");\n        }\n\n        JsonObjectBuilder builder = jsonProvider().createObjectBuilder();\n\n        JsonObject newJsonObject = newMetadata.getJsonObject();\n        JsonObject currentJsonObject = registeredMetadata.getJsonObject();\n\n        LOG.debugf(\"Current client metadata: %s\", currentJsonObject.toString());\n\n        // Try to ensure the same order of properties as in the original metadata\n        for (Map.Entry<String, JsonValue> entry : currentJsonObject.entrySet()) {\n            if (PRIVATE_PROPERTIES.contains(entry.getKey())) {\n                continue;\n            }","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/runtime/RegisteredClientImpl.java#L72-L108","documentation":"RegisteredClientImpl.update validates that the new client metadata does not change immutable fields. If the submitted ClientMetadata contains a clientId that differs from the registered one, it throws OidcClientRegistrationException 'Client id can not be modified' before issuing any HTTP request, because OIDC dynamic client registration (RFC 7592) treats client_id as immutable.","triggerScenarios":"Calling update(newMetadata) where newMetadata.getClientId() is non-null and different from registeredMetadata.getClientId().","commonSituations":"Copying metadata from another client into an update call, loading metadata from a config/JSON where client_id drifted after re-registration, or serializing/deserializing metadata incorrectly.","solutions":["Remove the clientId field from the update metadata (leave it null) — it is not updatable","Fetch the current RegisteredClient and update only mutable fields (redirect URIs, grants, etc.)","If a new client_id is genuinely needed, perform a fresh registration instead of an update"],"exampleFix":"// before\nClientMetadata meta = ClientMetadata.builder().clientId(\"other-id\").redirectUris(...).build();\nclient.update(meta); // throws\n// after\nClientMetadata meta = ClientMetadata.builder() // no clientId set\n        .redirectUris(List.of(\"https://app.example.com/cb\"))\n        .build();\nclient.update(meta);","handlingStrategy":"validation","validationCode":"if (newMetadata.getClientId() != null && !registeredClientId.equals(newMetadata.getClientId())) {\n    throw new IllegalArgumentException(\"clientId is immutable; omit it from update metadata\");\n}","typeGuard":"static boolean isUpdatable(ClientMetadata registered, ClientMetadata update) {\n    return update.getClientId() == null || registered.getClientId().equals(update.getClientId());\n}","tryCatchPattern":"try {\n    client.update(newMetadata).await().indefinitely();\n} catch (OidcClientRegistrationException e) {\n    if (e.getMessage().startsWith(\"Client id can not be modified\")) {\n        // rebuild metadata without clientId and retry once\n    } else throw e;\n}","preventionTips":["Never copy clientId from other clients into update metadata","Build update metadata fresh with only mutable fields","Treat client_id and client_secret as immutable per RFC 7592"],"tags":["oidc","client-registration","immutable-field"],"backgroundTag":"immutable-field-update","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}