{"record":{"id":"b55abb5b7ccc7cfb","repo":"provectus/kafka-ui","slug":"oauth2-authentication-is-enabled-but-no-providers","errorCode":null,"errorMessage":"OAuth2 authentication is enabled but no providers specified.","messagePattern":"OAuth2 authentication is enabled but no providers specified\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"kafka-ui-api/src/main/java/com/provectus/kafka/ui/config/auth/OAuthSecurityConfig.java","lineNumber":103,"sourceCode":"        .flatMap(user -> {\n          var provider = getProviderByProviderId(request.getClientRegistration().getRegistrationId());\n          final var extractor = getExtractor(provider, acs);\n          if (extractor == null) {\n            return Mono.just(user);\n          }\n\n          return extractor.extract(acs, user, Map.of(\"request\", request, \"provider\", provider))\n              .map(groups -> new RbacOAuth2User(user, groups));\n        });\n  }\n\n  @Bean\n  public InMemoryReactiveClientRegistrationRepository clientRegistrationRepository() {\n    final OAuth2ClientProperties props = OAuthPropertiesConverter.convertProperties(properties);\n    final List<ClientRegistration> registrations =\n        new ArrayList<>(new OAuth2ClientPropertiesMapper(props).asClientRegistrations().values());\n    if (registrations.isEmpty()) {\n      throw new IllegalArgumentException(\"OAuth2 authentication is enabled but no providers specified.\");\n    }\n    return new InMemoryReactiveClientRegistrationRepository(registrations);\n  }\n\n  @Bean\n  public ServerLogoutSuccessHandler defaultOidcLogoutHandler(final ReactiveClientRegistrationRepository repository) {\n    return new OidcClientInitiatedServerLogoutSuccessHandler(repository);\n  }\n\n  @Nullable\n  private ProviderAuthorityExtractor getExtractor(final OAuthProperties.OAuth2Provider provider,\n                                                  AccessControlService acs) {\n    Optional<ProviderAuthorityExtractor> extractor = acs.getOauthExtractors()\n        .stream()\n        .filter(e -> e.isApplicable(provider.getProvider(), provider.getCustomParams()))\n        .findFirst();\n\n    return extractor.orElse(null);","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/provectus/kafka-ui/blob/83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7/kafka-ui-api/src/main/java/com/provectus/kafka/ui/config/auth/OAuthSecurityConfig.java#L85-L121","documentation":"When OAuth2 authentication is enabled, the clientRegistrationRepository bean converts configured OAuth providers into Spring ClientRegistrations. If the conversion yields an empty list — meaning auth was turned on but no providers were configured — it throws IllegalArgumentException at bean creation, failing context startup.","triggerScenarios":"Setting kafka-ui auth.type=OAUTH2 (or equivalent) without defining any providers under spring.security.oauth2.client.registration (or the kafka-ui oauth provider list).","commonSituations":"Enabling OAuth2 via env var but forgetting provider env vars; mis-typed provider property keys so the converter maps nothing; upgrade where provider config keys moved and old ones are silently ignored.","solutions":["Define at least one OAuth2 provider (client-id, client-secret, issuer/scope) in the oauth properties","Verify property keys match what OAuthPropertiesConverter expects for your version","If OAuth2 is not needed, disable it instead of enabling with zero providers"],"exampleFix":"// before\nauth:\n  type: OAUTH2\n# no providers configured\n// after\nauth:\n  type: OAUTH2\noauth2:\n  client:\n    registration:\n      keycloak:\n        client-id: kafka-ui\n        client-secret: secret\n        scope: openid\n        redirect-uri: '{baseUrl}/login/oauth2/code/{registrationId}'","handlingStrategy":"validation","validationCode":"if auth_type == 'OAUTH2':\n    providers = config.get('oauth2', {}).get('client', {}).get('registration', {})\n    if not providers:\n        raise ValueError('OAUTH2 enabled but no providers registered')","typeGuard":null,"tryCatchPattern":"try:\n    startApp()\nexcept IllegalArgumentException as e:\n    if 'no providers specified' in str(e):\n        configureOAuthProvider()  # supply client-id/secret/issuer then restart","preventionTips":["Pair every auth.type change with its required provider properties","Templated deploys: fail early when OAUTH2 is on but provider env vars are empty","Verify provider keys against the version's OAuthPropertiesConverter"],"tags":["oauth2","authentication","configuration","startup"],"backgroundTag":"missing-required-config-field","analyzedSha":"83b5a60cc08501b570a0c4d0b4cdfceb1b88d6b7","analyzedAt":"2026-09-08T04:35:39.002Z","contentChangedAt":"2026-09-08T04:35:39.002Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}