{"record":{"id":"9f1d04a9af382204","repo":"quarkusio/quarkus","slug":"userinfo-is-not-required-but-s-is-enabled","errorCode":null,"errorMessage":"UserInfo is not required but '%s' is enabled","messagePattern":"UserInfo is not required but '(.+?)' is enabled","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":222,"sourceCode":"                throw new ConfigurationException(\n                        \"'\" + getConfigPropertyForTenant(tenantId, \"auth-server-url\") + \"' property must be configured\");\n            }\n            OidcCommonUtils.verifyEndpointUrl(oidcConfig.authServerUrl().get());\n            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, OidcUtils.isServiceApp(oidcConfig), true);\n            verifyAllowedRoutes(oidcConfig, tenantId);\n        } catch (ConfigurationException t) {\n            return Uni.createFrom().failure(t);\n        }\n\n        if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo\n                && !enableUserInfo(oidcConfig)) {\n            throw new ConfigurationException(\n                    \"UserInfo is not required but UserInfo is expected to be the source of authorization roles\");\n        }\n        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)\n                && !enableUserInfo(oidcConfig)) {\n            String propertyName = getConfigPropertyForTenant(tenantId, \"token.verify-access-token-with-user-info\");\n            throw new ConfigurationException(\"UserInfo is not required but '%s' is enabled\".formatted(propertyName));\n        }\n        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)\n                && StepUpAuthenticationPolicy.isEnabled()) {\n            String propertyName = getConfigPropertyForTenant(tenantId, \"authentication.id-token-required\");\n            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not\n            // required for this tenant, which we cannot know\n            LOG.warnf(\"Step Up Authentication is not supported for tenant '%s', because the internal IdToken is\"\n                    + \" generated by Quarkus. Please see the '%s' configuration property documentation for more information\",\n                    tenantId, propertyName);\n        }\n        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)\n                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {\n            throw new ConfigurationException(\n                    \"UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token\"\n                            .formatted(tenantId));\n        }\n\n        if (!oidcConfig.discoveryEnabled().orElse(true)) {","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L204-L240","documentation":"quarkus.oidc.token.verify-access-token-with-user-info makes Quarkus verify opaque/bearer access tokens via the UserInfo endpoint, but that verification can only happen if UserInfo is actually fetched (required). When the option is enabled on a non-web-app tenant without UserInfo being required, createTenantContext throws this ConfigurationException naming the offending property.","triggerScenarios":"createTenantContext finds oidcConfig.token().verifyAccessTokenWithUserInfo() == true while the tenant is not a web-app (OidcUtils.isWebApp false) and enableUserInfo(oidcConfig) is false — e.g. quarkus.oidc.token.verify-access-token-with-user-info=true set on a service/hybrid tenant without user-info-required=true.","commonSituations":"Enabling access-token-via-UserInfo verification for a Bearer-token (service) application; switching application-type from web-app to service and leaving the verify flag on; profile override that turns off user-info-required while the verify flag remains enabled.","solutions":["Set quarkus.oidc.authentication.user-info-required=true so UserInfo is fetched and can verify tokens.","Or remove quarkus.oidc.token.verify-access-token-with-user-info if the access token is a JWT verified via JWKS instead.","Or set application-type=web-app if the app really is a code-flow app."],"exampleFix":"// before\nquarkus.oidc.application-type=service\nquarkus.oidc.token.verify-access-token-with-user-info=true\n\n// after\nquarkus.oidc.application-type=service\nquarkus.oidc.token.verify-access-token-with-user-info=true\nquarkus.oidc.authentication.user-info-required=true","handlingStrategy":"validation","validationCode":"if (\"true\".equals(config.getProperty(\"quarkus.oidc.token.verify-access-token-with-user-info\"))\n        && !\"web-app\".equals(config.getProperty(\"quarkus.oidc.application-type\"))\n        && !\"true\".equals(config.getProperty(\"quarkus.oidc.authentication.user-info-required\"))) {\n    throw new IllegalStateException(\"verify-access-token-with-user-info needs user-info-required=true for non web-app tenants\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only enable verify-access-token-with-user-info on tenants where UserInfo is guaranteed to be fetched.","Re-check token options after changing application-type to/from service.","Keep OIDC tenant settings grouped and reviewed together per tenant."],"tags":["oidc","configuration","userinfo","access-token","startup"],"backgroundTag":"inconsistent-oidc-userinfo-config","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}