{"record":{"id":"7f88a31e012727e1","repo":"quarkusio/quarkus","slug":"1-scredentials-jwt-source-is-set-to-spiffe-jwt","errorCode":null,"errorMessage":"'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available. Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API","messagePattern":"'%1\\$scredentials\\.jwt\\.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available\\. Either set '%1\\$scredentials\\.jwt\\.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":253,"sourceCode":"        }\n        if (jwtSecretConfigured && jwtBearerOrSpiffe) {\n            throw new ConfigurationException(\n                    String.format(\n                            \"Only one of JWT secret or JWT bearer/SPIFFE authentication methods can be configured,\"\n                                    + \" but '%1$scredentials' has both a JWT secret and '%1$scredentials.jwt.source=%2$s' set\",\n                            configPrefix, creds.jwt().source().toString().toLowerCase()));\n        }\n\n        Credentials.Jwt jwt = creds.jwt();\n        if (jwt.source() == Source.BEARER) {\n            if (isServerConfig && jwt.tokenPath().isEmpty()) {\n                throw new ConfigurationException(\n                        String.format(\"'%scredentials.jwt.token-path' must be set when the JWT source is 'bearer'\",\n                                configPrefix));\n            }\n        } else if (jwt.source() == Source.SPIFFE_JWT) {\n            if (jwt.tokenPath().isEmpty() && Arc.container().select(SpiffeClient.class).isUnsatisfied()) {\n                throw new ConfigurationException(String.format(\n                        \"'%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available.\"\n                                + \" Either set '%1$scredentials.jwt.token-path' to a file containing the JWT-SVID,\"\n                                + \" or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs\"\n                                + \" from the SPIFFE Workload API\",\n                        configPrefix));\n            }\n        } else if (jwt.source() == Source.CLIENT && jwt.tokenPath().isPresent()) {\n            throw new ConfigurationException(String.format(\n                    \"'%scredentials.jwt.token-path' can only be set when the JWT source is 'bearer' or 'spiffe-jwt'\",\n                    configPrefix));\n        }\n    }\n\n    public static String prependSlash(String path) {\n        return !path.startsWith(\"/\") ? \"/\" + path : path;\n    }\n\n    public static Buffer encodeForm(MultiMap form) {","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L235-L271","documentation":"With credentials.jwt.source=spiffe-jwt, the JWT-SVID can come either from a token-path file or from the SPIFFE Workload API via the quarkus-spiffe-client extension. verifyCommonConfiguration checks at runtime (Arc.container().select(SpiffeClient.class).isUnsatisfied()) that at least one provider exists; if token-path is empty and no SpiffeClient bean is available, startup fails.","triggerScenarios":"credentials.jwt.source=spiffe-jwt with empty credentials.jwt.token-path AND no SpiffeClient bean in the CDI container (quarkus-spiffe-client extension not added / bean unsatisfied).","commonSituations":"Running in a SPIFFE-enabled cluster but forgetting to add the quarkus-spiffe-client dependency; expecting SPIFFE to be auto-detected without configuring token-path; wrong property name so token-path resolves empty.","solutions":["Add the quarkus-spiffe-client extension dependency so Quarkus can fetch JWT-SVIDs from the SPIFFE Workload API, e.g. quarkus ext add quarkus-spiffe-client","Or set quarkus.oidc[-client].credentials.jwt.token-path to a file containing the JWT-SVID","Verify the property prefix is correct and the spiffe-jwt source is intended for this provider"],"exampleFix":"# before (pom.xml has no spiffe client, no token-path)\nquarkus.oidc.credentials.jwt.source=spiffe-jwt\n\n# after\nquarkus.oidc.credentials.jwt.source=spiffe-jwt\nquarkus.oidc.credentials.jwt.token-path=/run/secrets/spiffe/jwt-svid","handlingStrategy":"fallback","validationCode":"String source = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.jwt.source\", String.class).orElse(null);\nString tokenPath = ConfigProvider.getConfig().getOptionalValue(\"quarkus.oidc.credentials.jwt.token-path\", String.class).orElse(null);\nif (\"spiffe-jwt\".equals(source) && (tokenPath == null || tokenPath.isBlank()))\n    log.warn(\"spiffe-jwt source with no token-path: ensure quarkus-spiffe-client extension is on the classpath\");","typeGuard":null,"tryCatchPattern":"try {\n    start();\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"SPIFFE\")) log.error(\"Add quarkus-spiffe-client or set jwt.token-path to a JWT-SVID file\");\n    throw e;\n}","preventionTips":["Add quarkus-spiffe-client whenever using jwt.source=spiffe-jwt without a token-path","Verify the workload runtime actually provides the SPIFFE Workload API socket","Document the two supported SVID sources (file vs Workload API) for the team"],"tags":["quarkus","oidc","spiffe","configuration"],"backgroundTag":"missing-required-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}