{"record":{"id":"852c651439a0270d","repo":"quarkusio/quarkus","slug":"s-must-be-enabled-to-use-s","errorCode":null,"errorMessage":"'%s' must be enabled to use '%s'","messagePattern":"'(.+?)' must be enabled to use '(.+?)'","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":310,"sourceCode":"                    && oidcConfig.roles().source().get() == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.idtoken) {\n                throw new ConfigurationException(\n                        \"The '\" + getConfigPropertyForTenant(tenantId, \"roles.source\")\n                                + \"' property can only be set to 'idtoken' for \"\n                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP\n                                + \" application types\");\n            }\n        } else {\n            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {\n                oidcConfig.token.setRefreshExpired(true);\n            }\n            if (oidcConfig.authentication().sessionAgeExtension().isPresent()\n                    && !oidcConfig.token().refreshExpired()) {\n                LOG.warn(\n                        \"Session age extension will not be effective because 'quarkus.oidc.token.refresh-expired=true' is not set\");\n            }\n            if (!oidcConfig.token().refreshExpired()\n                    && !oidcConfig.token().refreshTokenCacheTimeToLive().isZero()) {\n                throw new ConfigurationException(\n                        \"'\" + getConfigPropertyForTenant(tenantId, \"token.refresh-expired\")\n                                + \"' must be enabled to use '\"\n                                + getConfigPropertyForTenant(tenantId, \"token.refresh-token-cache-time-to-live\")\n                                + \"'\");\n            }\n        }\n\n        if (oidcConfig.tokenStateManager()\n                .strategy() != io.quarkus.oidc.runtime.OidcTenantConfig.TokenStateManager.Strategy.KEEP_ALL_TOKENS) {\n\n            if (oidcConfig.authentication().userInfoRequired().orElse(false)\n                    || oidcConfig.roles().source()\n                            .orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo) {\n                throw new ConfigurationException(\n                        \"UserInfo is required but DefaultTokenStateManager is configured to not keep the access token\");\n            }\n            if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.accesstoken) {\n                throw new ConfigurationException(","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L292-L328","documentation":"token.refresh-token-cache-time-to-live controls caching of refreshed tokens, which only exists when token.refresh-expired=true is set. Quarkus OIDC validates this dependency when building the tenant context and throws a ConfigurationException if the cache TTL is set while refresh is disabled.","triggerScenarios":"oidcConfig.token().refreshExpired() is false and token().refreshTokenCacheTimeToLive() is non-zero during createTenantContext (web-app branch of validation).","commonSituations":"Setting quarkus.oidc.token.refresh-token-cache-time-to-live without also setting refresh-expired=true; inheriting a default/typed OidcTenantConfig where a non-zero TTL was set programmatically; copy-pasting token config across tenants.","solutions":["Set quarkus.oidc.token.refresh-expired=true if token refresh with caching is intended","Remove/quarkus.oidc.token.refresh-token-cache-time-to-live (leave it at PT0S) if refresh is not used","Check per-tenant overrides: quarkus.oidc.<tenant>.token.refresh-token-cache-time-to-live"],"exampleFix":"// before\nquarkus.oidc.token.refresh-token-cache-time-to-live=1H\n// after\nquarkus.oidc.token.refresh-expired=true\nquarkus.oidc.token.refresh-token-cache-time-to-live=1H","handlingStrategy":"validation","validationCode":"if (!config.token().refreshExpired() && !config.token().refreshTokenCacheTimeToLive().isZero()) {\n    throw new IllegalArgumentException(\"refresh-token-cache-time-to-live requires token.refresh-expired=true\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set refresh-expired=true before any refresh-cache tuning","Review token.* properties as a group when editing tenant config"],"tags":["quarkus","oidc","configuration","token-refresh"],"backgroundTag":"oidc-dependent-config-missing","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}