{"record":{"id":"a934efe65639c327","repo":"quarkusio/quarkus","slug":"credentials-jwt-source-is-set-to-spiffe-jwt-b-a934ef","errorCode":null,"errorMessage":"'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available. Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API","messagePattern":"'credentials\\.jwt\\.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available\\. Either set 'credentials\\.jwt\\.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":1015,"sourceCode":"            if (clientAssertionProvider.getAvailableClientAssertion() == null) {\n                LOG.warnf(\"Cannot find a valid %s token at path: %s, deferring token loading to request time\",\n                        jwtConfig.source() == Source.SPIFFE_JWT ? \"SPIFFE JWT-SVID\" : \"JWT bearer\",\n                        jwtConfig.tokenPath().get());\n            }\n            return clientAssertionProvider;\n        } else if (jwtConfig.source() == Source.SPIFFE_JWT) {\n            var audience = jwtConfig.audience().or(() -> authServerUrl).orElseThrow(\n                    () -> new ConfigurationException(\n                            \"'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available.\"\n                                    + \" Either set 'credentials.jwt.audience' or 'auth-server-url'\"));\n            var clientAssertionProvider = SpiffeClientAssertionProvider.forAudience(vertx, audience);\n            if (clientAssertionProvider == null) {\n                throw new ConfigurationException(\n                        \"'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available.\"\n                                + \" Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID,\"\n                                + \" or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs\"\n                                + \" from the SPIFFE Workload API\");\n            }\n            return clientAssertionProvider;\n        }\n        return null;\n    }\n\n    public static Object getClientAssertionTokenType(Source source) {\n        return switch (source) {\n            case BEARER, CLIENT -> \"JWT bearer\";\n            case SPIFFE_JWT -> \"SPIFFE JWT-SVID\";\n        };\n    }\n\n}\n","sourceCodeStart":997,"sourceCodeEnd":1029,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L997-L1029","documentation":"Thrown by OidcCommonUtils when the OIDC client is configured with credentials.jwt.source=spiffe-jwt but no SPIFFE JWT-SVID provider could be resolved. The provider is either an explicit token file via credentials.jwt.token-path or the quarkus-spiffe-client extension, which fetches SVIDs from the SPIFFE Workload API. Without one of these, the client cannot produce a JWT client assertion.","triggerScenarios":"Setting quarkus.oidc.credentials.jwt.source=spiffe-jwt (or in an OidcClient config) without credentials.jwt.token-path, and without quarkus-spiffe-client on the classpath; calling getClientAssertionJwtSource where clientAssertionProvider is null.","commonSituations":"Copying SPIFFE config from docs/examples while forgetting to add the quarkus-spiffe-client dependency; migrating to SPIFFE auth in Kubernetes/Consul meshes where the Workload API socket path is wrong or extension missing; typo in token-path.","solutions":["Add io.quarkus:quarkus-spiffe-client to fetch JWT-SVIDs from the SPIFFE Workload API","Set quarkus.oidc.credentials.jwt.token-path to a file containing a valid JWT-SVID","Verify the SPIFFE Workload API endpoint/socket is reachable so the extension can register a provider"],"exampleFix":"// before\nquarkus.oidc.credentials.jwt.source=spiffe-jwt\n// after\nquarkus.oidc.credentials.jwt.source=spiffe-jwt\nquarkus.oidc.credentials.jwt.token-path=/run/spire/agent/sockets/svid.jwt\n# or add dependency: io.quarkus:quarkus-spiffe-client","handlingStrategy":"validation","validationCode":"if (config.getCredentials().getJwt().getSource() == OidcClientCommonConfig.Credentials.Jwt.Source.SPIFFE_JWT\n        && (config.getCredentials().getJwt().getTokenPath().isEmpty()\n            || !hasSpiffeClientExtension())) {\n    throw new IllegalStateException(\"spiffe-jwt requires token-path or the quarkus-spiffe-client extension\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["When choosing spiffe-jwt source, always add quarkus-spiffe-client or set token-path","Verify SPIFFE Workload API availability in the target environment","Add a startup-time config sanity check in tests"],"tags":["quarkus","oidc","configuration","spiffe"],"backgroundTag":"missing-scope-error","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}