{"record":{"id":"913ff3ffc87f44c5","repo":"quarkusio/quarkus","slug":"s-property-must-be-configured","errorCode":null,"errorMessage":"'%s' property must be configured","messagePattern":"'(.+?)' property must be configured","errorType":"validation","errorClass":"io.quarkus.runtime.configuration.ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":204,"sourceCode":"            if (oidcConfig.certificateChain().trustStoreFile().isPresent()) {\n                return createTenantContextToVerifyCertChain(oidcConfig);\n            }\n        }\n\n        try {\n            if (oidcConfig.authServerUrl().isEmpty()) {\n                if (DEFAULT_TENANT_ID.equals(oidcConfig.tenantId().get())) {\n                    ArcContainer container = Arc.container();\n                    if (container != null\n                            && (container.instance(TenantConfigResolver.class).isAvailable() || checkNamedTenants)) {\n                        LOG.debugf(\"Default tenant is not configured and will be disabled\"\n                                + \" because either 'TenantConfigResolver' which will resolve tenant configurations is registered\"\n                                + \" or named tenants are configured.\");\n                        oidcConfig.tenantEnabled = false;\n                        return TenantConfigContext.createReady(new OidcProvider(null, null, null), oidcConfig);\n                    }\n                }\n                throw new ConfigurationException(\n                        \"'\" + getConfigPropertyForTenant(tenantId, \"auth-server-url\") + \"' property must be configured\");\n            }\n            OidcCommonUtils.verifyEndpointUrl(oidcConfig.authServerUrl().get());\n            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, OidcUtils.isServiceApp(oidcConfig), true);\n            verifyAllowedRoutes(oidcConfig, tenantId);\n        } catch (ConfigurationException t) {\n            return Uni.createFrom().failure(t);\n        }\n\n        if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo\n                && !enableUserInfo(oidcConfig)) {\n            throw new ConfigurationException(\n                    \"UserInfo is not required but UserInfo is expected to be the source of authorization roles\");\n        }\n        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)\n                && !enableUserInfo(oidcConfig)) {\n            String propertyName = getConfigPropertyForTenant(tenantId, \"token.verify-access-token-with-user-info\");\n            throw new ConfigurationException(\"UserInfo is not required but '%s' is enabled\".formatted(propertyName));","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L186-L222","documentation":"Every enabled OIDC tenant that does not use a TenantConfigResolver must know the OIDC provider's auth-server-url. When createTenantContext builds a tenant with no auth-server-url and no resolver/named-tenant fallback applies, it throws this ConfigurationException naming the exact property expected (e.g. quarkus.oidc.auth-server-url or quarkus.oidc.<tenant>.auth-server-url).","triggerScenarios":"Tenant is enabled and no TenantConfigResolver is registered, oidcConfig.authServerUrl().isEmpty(), and the early-return path for disabled/resolver-only configurations did not apply — i.e. quarkus.oidc.auth-server-url (or quarkus.oidc.<tenant>.auth-server-url) is missing while OIDC is active.","commonSituations":"Typo like quarkus.oidc.aut-server-url or wrong prefix; adding quarkus-oidc dependency without configuring it; referencing a named tenant (e.g. quarkus.oidc.partner.*) but forgetting its auth-server-url; config not loaded from the right profile (e.g. only in %prod when running dev).","solutions":["Set quarkus.oidc.auth-server-url=<issuer url> (or quarkus.oidc.<tenant>.auth-server-url for a named tenant) as indicated in the message.","If you have no OIDC server yet, remove the quarkus-oidc dependency or disable the tenant with quarkus.oidc.tenant-enabled=false.","If tenant configs are meant to be supplied at runtime, register an OidcTenantConfigResolver bean so the static auth-server-url is not required.","Verify the property is present in the active profile (check config source / -Dquarkus.profile)."],"exampleFix":"// before (application.properties)\nquarkus.oidc.tenant-enabled=true\n\n// after\nquarkus.oidc.auth-server-url=https://idp.example.com/realms/main","handlingStrategy":"validation","validationCode":"if (config.getProperty(\"quarkus.oidc.auth-server-url\") == null) {\n    throw new IllegalStateException(\"quarkus.oidc.auth-server-url must be set when quarkus-oidc is on the classpath\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add auth-server-url to every tenant block you define.","Check the active Quarkus profile contains the property (config not lost in %dev/%prod).","Watch for typos: the property must be exactly auth-server-url.","Use a config linter or SmallRye config mapping to catch missing required values early."],"tags":["oidc","configuration","missing-property","startup"],"backgroundTag":"missing-required-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}