{"record":{"id":"692a88a7dbf87e2f","repo":"quarkusio/quarkus","slug":"token-decryption-key-for-tenant-s-can-not-be-read","errorCode":null,"errorMessage":"Token decryption key for tenant %s can not be read from %s","messagePattern":"Token decryption key for tenant (.+?) can not be read from (.+?)","errorType":"validation","errorClass":"io.quarkus.runtime.configuration.ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContextImpl.java","lineNumber":110,"sourceCode":"\n    @Override\n    public Map<Redirect.Location, List<OidcRedirectFilter>> getLocationToRedirectFilters() {\n        return redirectFilters;\n    }\n\n    private static boolean providerIsNoNull(OidcProvider provider) {\n        return provider != null && provider.client != null;\n    }\n\n    private static Key createTokenDecryptionKey(OidcProvider provider, String clientSecret) {\n        Key key = null;\n\n        OidcTenantConfig oidcConfig = provider.oidcConfig;\n        if (oidcConfig.token().decryptionKeyLocation().isPresent()) {\n            try {\n                return OidcUtils.readDecryptionKey(oidcConfig.token().decryptionKeyLocation().get());\n            } catch (Exception ex) {\n                throw new ConfigurationException(\n                        String.format(\"Token decryption key for tenant %s can not be read from %s\",\n                                oidcConfig.tenantId().get(), oidcConfig.token().decryptionKeyLocation().get()),\n                        ex);\n            }\n        }\n\n        if (oidcConfig.token().decryptIdToken().orElse(false) || oidcConfig.token().decryptAccessToken()) {\n            if (provider.client.getClientJwtKey() != null) {\n                key = provider.client.getClientJwtKey();\n            } else if (clientSecret != null) {\n                key = OidcUtils.createSecretKeyFromDigest(clientSecret);\n            }\n        }\n        return key;\n    }\n\n    private static SecretKey createStateSecretKey(OidcTenantConfig config, String possiblePkceSecret) {\n        if (config.authentication().pkceRequired().orElse(false) || config.authentication().nonceRequired()) {","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantConfigContextImpl.java#L92-L128","documentation":"TenantConfigContextImpl.createTokenDecryptionKey throws ConfigurationException when the token decryption key file configured via quarkus.oidc.<tenant>.token.decryption-key-location cannot be read. Reading is delegated to OidcUtils.readDecryptionKey and any failure (missing file, malformed PEM) is wrapped with the tenant id and location.","triggerScenarios":"Building the tenant's ready context (createReady/tokenDecryptionKey) with oidcConfig.token().decryptionKeyLocation() present; OidcUtils.readDecryptionKey throws (file not found, unreadable, invalid PEM) and the exception is wrapped in ConfigurationException.","commonSituations":"Wrong path to the private key PEM; key mounted in a container at a different path; file permissions blocking read; key in DER/PKCS12 format not accepted as PEM.","solutions":["Fix quarkus.oidc.<tenant>.token.decryption-key-location to point to an existing readable PEM private key file","Verify the file is mounted/available in the runtime environment (container volume, k8s secret path)","Re-export the key in valid PEM (PKCS#8) format if the format is wrong"],"exampleFix":"// before\nquarkus.oidc.tenant-b.token.decryption-key-location=/wrong/path/key.pem\n// after\nquarkus.oidc.tenant-b.token.decryption-key-location=/deployments/keys/tenant-b-key.pem","handlingStrategy":"validation","validationCode":"Path keyPath = Path.of(config.decryptionKeyLocation());\nif (!Files.isReadable(keyPath)) throw new IllegalStateException(\"Decryption key unreadable: \" + keyPath);","typeGuard":null,"tryCatchPattern":"try { startApplication(); } catch (ConfigurationException e) { log.error(\"Fix token.decryption-key-location: \" + e.getMessage(), e.getCause()); }","preventionTips":["Verify key file paths inside the actual runtime image/container","Mount keys as read-only volumes with correct permissions","Validate keys are PEM (PKCS#8) format at deploy time"],"tags":["oidc","configuration","decryption-key","file-not-found"],"backgroundTag":"key-file-unreadable","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}