{"record":{"id":"7744385128f9c43f","repo":"quarkusio/quarkus","slug":"cannot-access-the-s-endpoint-for-client-s-beca","errorCode":null,"errorMessage":"Cannot access the %s endpoint for client '%s' because a JWT bearer client_assertion is not available","messagePattern":"Cannot access the (.+?) endpoint for client '(.+?)' because a JWT bearer client_assertion is not available","errorType":"exception","errorClass":"io.quarkus.oidc.runtime.OIDCException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProviderClientImpl.java","lineNumber":702,"sourceCode":"        setHttpAuthorization(request, clientCredentials, oidcConfig, MetadataOperation.DISCOVERY, asyncCredentials);\n    }\n\n    static PreparedHttpRequest.CredentialsToRetry setHttpAuthorizationForJwks(HttpRequest<Buffer> request,\n            ClientCredentials clientCredentials, OidcClientCommonConfig oidcConfig, AsyncCredentials asyncCredentials) {\n        return setHttpAuthorization(request, clientCredentials, oidcConfig, MetadataOperation.JWKS, asyncCredentials);\n    }\n\n    private static PreparedHttpRequest.CredentialsToRetry setHttpAuthorization(HttpRequest<Buffer> request,\n            ClientCredentials clientCredentials, OidcClientCommonConfig oidcConfig, MetadataOperation op,\n            AsyncCredentials asyncCredentials) {\n        if (clientCredentials.clientSecretBasicAuthScheme != null) {\n            request.putHeader(AUTHORIZATION_HEADER, clientCredentials.clientSecretBasicAuthScheme);\n            return PreparedHttpRequest.CredentialsToRetry.CLIENT_SECRET_BASIC_AUTH_SCHEME;\n        } else if (clientCredentials.jwtAssertionProvided && clientCredentials.clientAssertionProvider != null\n                && oidcConfig.credentials().jwt().source() == OidcClientCommonConfig.Credentials.Jwt.Source.BEARER) {\n            final String clientAssertion = asyncCredentials.clientAssertion;\n            if (clientAssertion == null) {\n                throw new OIDCException(String.format(\n                        \"Cannot access the %s endpoint for client '%s' because a JWT bearer client_assertion is not available\",\n                        op.operation(), oidcConfig.clientId().orElse(null)));\n            }\n            request.putHeader(AUTHORIZATION_HEADER, OidcConstants.BEARER_SCHEME + \" \" + clientAssertion);\n        }\n        return null;\n    }\n\n    private Uni<HttpResponse<Buffer>> withCredentialsRetry(PreparedHttpRequest preparedRequest,\n            Supplier<PreparedHttpRequest> refreshRequestSupplier) {\n        return preparedRequest.httpRequestUni.flatMap(httpResponse -> {\n            if (httpResponse.statusCode() == 401) {\n                // here we need to deal with error responses (like unauthorized_client) possibly caused by\n                // invalid credentialsToRetry; if credentialsToRetry provider updated credentialsToRetry, we should retry\n                var credentialsRefresh = switch (preparedRequest.credentialsToRetry) {\n                    case CLIENT_SECRET -> OidcCommonUtils.clientSecret(oidcConfig.credentials())\n                            .map(newClientSecret -> {\n                                if (newClientSecret != null && !newClientSecret.equals(clientSecret)) {","sourceCodeStart":684,"sourceCodeEnd":720,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProviderClientImpl.java#L684-L720","documentation":"Thrown by OidcProviderClientImpl when building an outgoing request that must use JWT-bearer client authentication (credentials.jwt.source=BEARER) but the async JWT bearer client_assertion is null at request time. The endpoint call cannot be authorized (no Authorization: Bearer header can be set), so an OIDCException naming the operation and client is thrown.","triggerScenarios":"Preparing a request to an OIDC operation (e.g. token, revocation, userinfo) with credentials.jwt.source=BEARER configured and a clientAssertionProvider present, while AsyncCredentials.clientAssertion is null — the JWT bearer assertion was never fetched or refresh failed.","commonSituations":"Private-key JWT client authentication (RFC 7523) with a missing/invalid signing key configuration; expired assertion whose renewal failed; secret-manager outages leaving the assertion unpopulated; misordering where the request fires before assertion provisioning completes.","solutions":["Verify quarkus.oidc.credentials.jwt.key / key-file / key-store-file resolve to valid signing material and are readable at runtime","Check logs for the assertion provider's earlier failure (secret fetch, key load) and fix that root cause","Confirm credentials.jwt.audience matches the authorization server's expected assertion audience","Temporarily switch to credentials.jwt.source=client or secret basic auth to validate the rest of the flow, then restore bearer"],"exampleFix":"# before: bearer source with no key\nquarkus.oidc.credentials.jwt.source=bearer\n# after\nquarkus.oidc.credentials.jwt.source=bearer\nquarkus.oidc.credentials.jwt.key-store-file=/secrets/keystore.p12\nquarkus.oidc.credentials.jwt.key-store-password=${KEYSTORE_PW}\nquarkus.oidc.credentials.jwt.key-id=token-key\nquarkus.oidc.credentials.jwt.audience=https://idp.example.com/protocol/openid-connect/token","handlingStrategy":"validation","validationCode":"// assert bearer assertion material exists before building the request\nif (oidcConfig.credentials().jwt().source() == Jwt.Source.BEARER\n    && (asyncCredentials.clientAssertion == null || asyncCredentials.clientAssertion.isBlank())) {\n    throw new IllegalStateException(\"Bearer client assertion unavailable; check jwt key configuration\");\n}","typeGuard":"boolean bearerAssertionReady(Credentials cfg, String assertion) {\n    return cfg.jwt().source() != Jwt.Source.BEARER || (assertion != null && !assertion.isBlank());\n}","tryCatchPattern":"try {\n    return client.send(op);\n} catch (OIDCException e) {\n    if (e.getMessage().contains(\"JWT bearer client_assertion is not available\")) {\n        asyncCredentials.refreshAssertion();\n        return client.send(op);\n    }\n    throw e;\n}","preventionTips":["Ensure key-store/key-file paths are valid in the target environment (container volumes, permissions)","Set assertion renewal well before expiry","Log assertion provisioning failures at startup rather than letting them surface at request time"],"tags":["oidc","client-assertion","jwt-bearer","authentication"],"backgroundTag":"missing-client-assertion","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}