{"record":{"id":"ae2b5b93d0d5a124","repo":"quarkusio/quarkus","slug":"failed-to-find-a-matching-oidctenantconfig-for-ten","errorCode":null,"errorMessage":"Failed to find a matching OidcTenantConfig for tenant: ","messagePattern":"Failed to find a matching OidcTenantConfig for tenant: ","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java","lineNumber":229,"sourceCode":"        config1.setClaimInformationPointConfig(\n                getClaimInformationPointConfig(pathConfig.claimInformationPoint()));\n        return config1;\n    }\n\n    private static boolean isNotComplexConfigKey(String key) {\n        // ignore complexConfig keys for reasons explained in the following comment:\n        // https://github.com/quarkusio/quarkus/issues/39315#issuecomment-1991604044\n        return !key.contains(\".\");\n    }\n\n    static OidcTenantConfig getOidcTenantConfig(TenantConfigBean tenantConfigBean, String tenant) {\n        if (tenant == null || DEFAULT_TENANT_ID.equals(tenant)) {\n            return tenantConfigBean.getDefaultTenant().getOidcTenantConfig();\n        }\n\n        var staticTenant = tenantConfigBean.getStaticTenant(tenant);\n        if (staticTenant == null || staticTenant.oidcConfig() == null) {\n            throw new ConfigurationException(\"Failed to find a matching OidcTenantConfig for tenant: \" + tenant);\n        }\n        return staticTenant.oidcConfig();\n    }\n}\n","sourceCodeStart":211,"sourceCodeEnd":234,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java#L211-L234","documentation":"getOidcTenantConfig looks up the tenant configuration for the given tenant id from the TenantConfigBean; when a non-default tenant has no statically configured OidcTenantConfig, a ConfigurationException is thrown. The policy enforcer cannot operate without tenant configuration.","triggerScenarios":"Requesting/creating a policy enforcer for a tenant id that has no matching quarkus.oidc.<tenant>. configuration (static tenants only) — e.g. tenant resolved from the token issuer or a tenant-path/tenant-id connection parameter that doesn't match any configured tenant, and no dynamic tenant config is registered.","commonSituations":"Renamed or removed tenant config keys (quarkus.oidc.\"my-tenant\".auth-server-url) while code still references the old tenant id; issuer-based tenant resolution matching no static tenant; typos in tenant identifiers; relying on tenants only created dynamically at runtime without a dynamic resolver.","solutions":["Define configuration for the missing tenant: quarkus.oidc.\"<tenant>\".auth-server-url=... (and client-id/credentials) so getStaticTenant finds it.","Verify the tenant id being passed matches the quoted config key exactly (case-sensitive) and the resolved tenant from the request.","If tenants are dynamic, ensure a dynamic tenants config provider is set up so lookup doesn't rely on static tenants only.","Use the default tenant (remove the tenant attribute/parameter) if per-tenant config isn't actually needed."],"exampleFix":"// before (tenant 'acme' referenced but not configured)\nquarkus.oidc.auth-server-url=https://sso/realms/main\n// after\nquarkus.oidc.\"acme\".auth-server-url=https://sso/realms/acme\nquarkus.oidc.\"acme\".client-id=pep-client","handlingStrategy":"validation","validationCode":"// check tenant config exists before requesting a per-tenant policy enforcer\nString tenant = resolvedTenantId;\nif (!DEFAULT_TENANT.equals(tenant) && staticTenantIds.stream().noneMatch(tenant::equals)) {\n    throw new IllegalStateException(\"No quarkus.oidc.\\\"\" + tenant + \"\\\" config; define it or use the default tenant\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    OidcTenantConfig cfg = KeycloakPolicyEnforcerUtil.getOidcTenantConfig(tenantConfigBean, tenant);\n} catch (ConfigurationException e) {\n    log.error(\"Tenant '{}' not configured: add quarkus.oidc.\\\"{}\\\".auth-server-url\", tenant, tenant, e);\n    throw e;\n}","preventionTips":["Keep tenant ids in code aligned exactly with quoted config keys (case-sensitive).","Add an integration test that resolves every tenant id used by the app.","When removing/renaming tenants, grep for hardcoded tenant identifiers.","Prefer default-tenant lookups when per-tenant config is unnecessary."],"tags":["oidc","tenant","configuration","keycloak"],"backgroundTag":"tenant-config-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}