{"record":{"id":"7bddf16cc11c0dd1","repo":"quarkusio/quarkus","slug":"tenant-absolute-redirect-callback-is-a-callback-m","errorCode":null,"errorMessage":"/tenant-absolute-redirect/callback is a callback method","messagePattern":"/tenant-absolute-redirect/callback is a callback method","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantAbsoluteRedirect.java","lineNumber":19,"sourceCode":"package io.quarkus.it.keycloak;\n\nimport jakarta.ws.rs.GET;\nimport jakarta.ws.rs.Path;\nimport jakarta.ws.rs.core.Context;\nimport jakarta.ws.rs.core.UriInfo;\n\nimport io.quarkus.security.Authenticated;\n\n@Path(\"/tenant-absolute-redirect\")\npublic class TenantAbsoluteRedirect {\n\n    @Context\n    UriInfo ui;\n\n    @GET\n    @Authenticated\n    public String getTenant() {\n        throw new RuntimeException(\"/tenant-absolute-redirect/callback is a callback method\");\n    }\n\n    @GET\n    @Authenticated\n    @Path(\"/callback\")\n    public String getTenantCallback() {\n        return ui.getAbsolutePath().toString();\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":29,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantAbsoluteRedirect.java#L1-L29","documentation":"Deliberate sentinel in TenantAbsoluteRedirect. The root path of this resource must never serve a response; only its /callback sub-path is legitimate (it is the OIDC redirect_uri for the tenant-absolute-redirect tenant). If the root endpoint executes, the OIDC flow redirected the user to the wrong path — the callback URL instead of the protected resource.","triggerScenarios":"The tenant's redirect-uri / absolute redirect path is misconfigured so the OIDC callback lands on the resource root instead of /tenant-absolute-redirect/callback.","commonSituations":"Wrong quarkus.oidc.<tenant>.redirect-path or absolute redirect URI in Keycloak client config; testing that only the callback method is ever invoked; copy-paste of tenant configs with stale paths.","solutions":["Fix the tenant's redirect-path so Keycloak redirects to /tenant-absolute-redirect/callback only","Verify the Keycloak client's valid redirect URIs match the configured callback path","Ensure the authenticated root resource is only requested after a completed callback"],"exampleFix":"// before\npublic String getTenant() {\n    throw new RuntimeException(\"/tenant-absolute-redirect/callback is a callback method\");\n}\n// after\n// Configure the tenant so only /callback is the redirect target:\nquarkus.oidc.tenant-absolute-redirect.redirect-path=/tenant-absolute-redirect/callback","handlingStrategy":"validation","validationCode":"// assert the OIDC redirect target is the callback path, not the resource root\nif (!redirectUri.endsWith(\"/tenant-absolute-redirect/callback\")) {\n    throw new IllegalStateException(\"redirect must target the callback path\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    given().get(\"/tenant-absolute-redirect\");\n} catch (RuntimeException e) {\n    // root endpoint invoked: fix quarkus.oidc.*.redirect-path config\n}","preventionTips":["Configure redirect-path to point only at the /callback sub-path","Match Keycloak client valid-redirect-URIs with the configured callback","Never request the protected root directly during flow tests"],"tags":["oidc","redirect-uri","tenant"],"backgroundTag":"wrong-redirect-path","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}