{"record":{"id":"84fe93a4a312cf70","repo":"quarkusio/quarkus","slug":"failed-to-parse-the-realm-name","errorCode":null,"errorMessage":"Failed to parse the realm name.","messagePattern":"Failed to parse the realm name\\.","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java","lineNumber":51,"sourceCode":"    static PolicyEnforcer createPolicyEnforcer(OidcTenantConfig oidcConfig,\n            KeycloakPolicyEnforcerTenantConfig keycloakPolicyEnforcerConfig,\n            TlsConfigSupport tlsConfigSupport,\n            ProxyConfigurationRegistry proxyConfigurationRegistry) {\n\n        if (oidcConfig.applicationType()\n                .orElse(OidcTenantConfig.ApplicationType.SERVICE) == OidcTenantConfig.ApplicationType.WEB_APP\n                && oidcConfig.roles().source().orElse(null) != OidcTenantConfig.Roles.Source.accesstoken) {\n            throw new OIDCException(\"Application 'web-app' type is only supported if access token is the source of roles\");\n        }\n\n        AdapterConfig adapterConfig = new AdapterConfig();\n        String authServerUrl = oidcConfig.authServerUrl().get();\n\n        try {\n            adapterConfig.setRealm(authServerUrl.substring(authServerUrl.lastIndexOf('/') + 1));\n            adapterConfig.setAuthServerUrl(authServerUrl.substring(0, authServerUrl.lastIndexOf(\"/realms\")));\n        } catch (Exception cause) {\n            throw new ConfigurationException(\"Failed to parse the realm name.\", cause);\n        }\n\n        adapterConfig.setResource(oidcConfig.clientId().get());\n        adapterConfig.setCredentials(getCredentials(oidcConfig));\n\n        if (!tlsConfigSupport.useTlsRegistry()) {\n            if (tlsConfigSupport.isGlobalTrustAll()) {\n                adapterConfig.setDisableTrustManager(true);\n                adapterConfig.setAllowAnyHostname(true);\n            }\n        }\n        adapterConfig.setConnectionPoolSize(keycloakPolicyEnforcerConfig.connectionPoolSize());\n\n        if (oidcConfig.proxy().proxyConfigurationName().isPresent()) {\n            ProxyConfiguration proxyConfig = proxyConfigurationRegistry\n                    .get(oidcConfig.proxy().proxyConfigurationName())\n                    .orElseThrow(() -> new ConfigurationException(\n                            \"Cannot find the Proxy registry configuration '%s'\"","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java#L33-L69","documentation":"createPolicyEnforcer derives the realm and auth-server base URL by string manipulation of quarkus.oidc.auth-server-url (splitting on the last '/realms' segment). If the URL does not contain '/realms' as expected, substring arithmetic fails or produces an invalid URL and a ConfigurationException wrapped around the cause is thrown.","triggerScenarios":"quarkus.oidc.auth-server-url does not follow the https://host/realms/<realm> shape — e.g. missing /realms segment, trailing garbage, or set via env var/property placeholder resolving to an unexpected value — while the policy enforcer builds the AdapterConfig.","commonSituations":"Typo like /realm/quarkus (singular) or /realms missing entirely; pointing at an intermediate proxy path that drops /realms; empty or malformed auth-server-url after environment substitution.","solutions":["Set quarkus.oidc.auth-server-url to the canonical form https://<host>/realms/<realm> and verify the resolved value (log or check startup config).","Check for typos (e.g. /realm/ vs /realms/) and stray spaces/trailing slashes in the property or env variable.","Ensure any property placeholder/env substitution produces a valid URL at runtime (e.g. print env in the container)."],"exampleFix":"// before\nquarkus.oidc.auth-server-url=https://sso.example.com/auth\n// after\nquarkus.oidc.auth-server-url=https://sso.example.com/realms/quarkus","handlingStrategy":"validation","validationCode":"String url = config.getOptionalValue(\"quarkus.oidc.auth-server-url\", String.class).orElse(\"\");\nif (!url.matches(\"https?://[^/]+/realms/[^\"]+\")) {\n    throw new IllegalStateException(\"auth-server-url must be https://host/realms/<realm>: \" + url);\n}","typeGuard":null,"tryCatchPattern":"try {\n    PolicyEnforcer pe = KeycloakPolicyEnforcerUtil.createPolicyEnforcer(...);\n} catch (ConfigurationException e) {\n    if (e.getMessage().contains(\"Failed to parse the realm name\")) {\n        log.error(\"auth-server-url must end with /realms/<realm>: {}\", oidcConfig.authServerUrl(), e.getCause());\n    }\n    throw e;\n}","preventionTips":["Always use the canonical https://host/realms/<realm> form for auth-server-url.","Watch for /realm/ vs /realms/ typos after refactoring.","Verify env-substituted URLs resolve correctly in containers.","Log the effective OIDC config at startup in non-prod to catch malformed URLs."],"tags":["oidc","configuration","keycloak","url"],"backgroundTag":"invalid-auth-server-url","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}