{"record":{"id":"6c94d7cd09e5b9ea","repo":"quarkusio/quarkus","slug":"web-app-applications-must-have-s-and-s-pro","errorCode":null,"errorMessage":"'web-app' applications must have '%s' and '%s' properties set when the discovery is disabled.","messagePattern":"'web-app' applications must have '(.+?)' and '(.+?)' properties set when the discovery is disabled\\.","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":245,"sourceCode":"            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not\n            // required for this tenant, which we cannot know\n            LOG.warnf(\"Step Up Authentication is not supported for tenant '%s', because the internal IdToken is\"\n                    + \" generated by Quarkus. Please see the '%s' configuration property documentation for more information\",\n                    tenantId, propertyName);\n        }\n        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)\n                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {\n            throw new ConfigurationException(\n                    \"UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token\"\n                            .formatted(tenantId));\n        }\n\n        if (!oidcConfig.discoveryEnabled().orElse(true)) {\n            if (!OidcUtils.isServiceApp(oidcConfig)) {\n                if (oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty()) {\n                    String authorizationPathProperty = getConfigPropertyForTenant(tenantId, \"authorization-path\");\n                    String tokenPathProperty = getConfigPropertyForTenant(tenantId, \"token-path\");\n                    throw new ConfigurationException(\n                            \"'web-app' applications must have '\" + authorizationPathProperty + \"' and '\" + tokenPathProperty\n                                    + \"' properties \"\n                                    + \"set when the discovery is disabled.\",\n                            Set.of(authorizationPathProperty, tokenPathProperty));\n                }\n            }\n            // JWK and introspection endpoints have to be set for both 'web-app' and 'service' applications\n            if (oidcConfig.jwksPath().isEmpty() && oidcConfig.introspectionPath().isEmpty()) {\n                if (!oidcConfig.authentication().idTokenRequired().orElse(true)\n                        && oidcConfig.authentication().userInfoRequired().orElse(false)) {\n                    LOG.debugf(\"tenant %s supports only UserInfo\", oidcConfig.tenantId().get());\n                } else if (OidcUtils.isServiceApp(oidcConfig)) {\n                    throw new ConfigurationException(\n                            \"Either 'jwks-path' or 'introspection-path' properties must be set when the discovery is disabled.\",\n                            Set.of(\"quarkus.oidc.jwks-path\", \"quarkus.oidc.introspection-path\"));\n                }\n            }\n            if (oidcConfig.authentication().userInfoRequired().orElse(false) && oidcConfig.userInfoPath().isEmpty()) {","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L227-L263","documentation":"With OIDC discovery disabled, Quarkus cannot locate the provider's authorization and token endpoints automatically. Web-app (code flow) applications need both endpoints to run the login flow. createTenantContext throws this ConfigurationException when discovery is off, the tenant is not a service app, and either authorization-path or token-path is missing.","triggerScenarios":"createTenantContext finds oidcConfig.discoveryEnabled() == false, OidcUtils.isServiceApp(oidcConfig) == false, and oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty() — i.e. quarkus.oidc.discovery-enabled=false without quarkus.oidc.authorization-path and quarkus.oidc.token-path on a web-app tenant.","commonSituations":"Disabling discovery for a legacy IdP without a well-known endpoint but only setting token-path; Keycloak behind a proxy that blocks /.well-known/openid-configuration so discovery was turned off; migrating a service config to web-app and inheriting the discovery-disabled setting.","solutions":["Set both quarkus.oidc.authorization-path and quarkus.oidc.token-path (the message lists the exact property names) to the provider's endpoint paths.","Or re-enable discovery (quarkus.oidc.discovery-enabled=true) if the provider exposes the well-known configuration.","If the app only uses bearer tokens, set quarkus.oidc.application-type=service so only jwks-path/introspection-path is required."],"exampleFix":"// before\nquarkus.oidc.discovery-enabled=false\nquarkus.oidc.token-path=/protocol/openid-connect/token\n\n// after\nquarkus.oidc.discovery-enabled=false\nquarkus.oidc.authorization-path=/protocol/openid-connect/auth\nquarkus.oidc.token-path=/protocol/openid-connect/token","handlingStrategy":"validation","validationCode":"if (\"false\".equals(config.getProperty(\"quarkus.oidc.discovery-enabled\"))\n        && (config.getProperty(\"quarkus.oidc.authorization-path\") == null\n            || config.getProperty(\"quarkus.oidc.token-path\") == null)) {\n    throw new IllegalStateException(\"web-app tenants need authorization-path and token-path when discovery is disabled\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Whenever disabling discovery, configure authorization-path, token-path, and jwks-path/introspection-path in the same commit.","Verify endpoint paths against the IdP documentation before deploying.","Consider enabling discovery first and only disabling it when the provider genuinely lacks the well-known endpoint."],"tags":["oidc","configuration","discovery","web-app","startup"],"backgroundTag":"missing-required-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}