{"record":{"id":"bddf1df40d3207f1","repo":"quarkusio/quarkus","slug":"oidc-discovery-endpoint-request-failed","errorCode":null,"errorMessage":"OIDC discovery endpoint request failed","messagePattern":"OIDC discovery endpoint request failed","errorType":"http","errorClass":"OidcEndpointAccessException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":706,"sourceCode":"                .flatMap(resp -> filterHttpResponse(requestProps, resp, responseFilters, Type.DISCOVERY)\n                        .map(buffer -> {\n                            if (resp.statusCode() == 200) {\n                                JsonObject discoveredJson = buffer.toJsonObject();\n                                LOG.debugf(\"Discovered OIDC metadata: %s\", discoveredJson);\n                                return discoveredJson;\n                            } else if (resp.statusCode() == 302) {\n                                throw createOidcClientRedirectException(resp);\n                            } else {\n                                String errorMessage = buffer != null ? buffer.toString() : null;\n                                if (errorMessage != null && !errorMessage.isEmpty()) {\n                                    LOG.warnf(\"Discovery request %s has failed, status code: %d, error message: %s\",\n                                            discoveryUrl,\n                                            resp.statusCode(), errorMessage);\n                                } else {\n                                    LOG.warnf(\"Discovery request %s has failed, status code: %d\", discoveryUrl,\n                                            resp.statusCode());\n                                }\n                                throw new OidcEndpointAccessException(resp.statusCode());\n                            }\n                        }))\n                .onFailure(oidcEndpointNotAvailable())\n                .retry()\n                .withBackOff(CONNECTION_BACKOFF_DURATION, CONNECTION_BACKOFF_DURATION)\n                .expireIn(connectionDelayInMillisecs);\n    }\n\n    public static OidcClientRedirectException createOidcClientRedirectException(HttpResponse<Buffer> resp) {\n        LOG.debug(\"OIDC client redirect is requested\");\n        return new OidcClientRedirectException(resp.getHeader(LOCATION_RESPONSE_HEADER), resp.cookies());\n    }\n\n    private static OidcRequestContextProperties getDiscoveryRequestProps(\n            OidcRequestContextProperties contextProperties, String discoveryUrl) {\n        Map<String, Object> newProperties = contextProperties == null ? new HashMap<>()\n                : new HashMap<>(contextProperties.getAll());\n        newProperties.put(OidcRequestContextProperties.DISCOVERY_ENDPOINT, discoveryUrl);","sourceCodeStart":688,"sourceCodeEnd":724,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L688-L724","documentation":"OIDC discovery (fetching the .well-known/openid-configuration metadata document) failed — the endpoint returned an error status or was unreachable, with retries/backoff exhausted. The underlying status is surfaced via OidcEndpointAccessException after a warning is logged with the discovery URL and status code.","triggerScenarios":"doDiscoverMetadata sends a GET to <auth-server-url>/.well-known/openid-configuration; the OIDC provider returns 4xx/5xx, or the connection fails and the retry policy (CONNECTION_BACKOFF_DURATION, expireIn connectionDelay) expires.","commonSituations":"Auth server URL wrong or realm missing (Keycloak needs /realms/<realm>); OIDC server down or restarting; TLS certificate not trusted; discovery disabled endpoint; container networking/DNS issues; connection-delay timeout too short for a slow provider.","solutions":["Verify the auth-server-url is correct and complete (for Keycloak include /realms/<realm>); test the discovery URL in a browser/curl","Check the OIDC provider is running and reachable from the app (network, DNS, firewall, k8s service)","Inspect the logged warning 'Discovery request ... has failed, status code' for the HTTP status and address TLS/proxy issues accordingly (import the IdP certificate if  SSL errors)","Increase quarkus.oidc.connection-delay (or connection-retry attempts) if the provider starts slowly","If the provider does not support discovery, disable it and configure endpoints manually (e.g. token-path, jwks-path, discovery-enabled=false)"],"exampleFix":"// before\nquarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/wrong-realm\n// after\nquarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus\nquarkus.oidc.connection-delay=10S","handlingStrategy":"retry","validationCode":"// verify discovery endpoint before startup\nHttpResponse<String> resp = HttpClient.newHttpClient().send(\n    HttpRequest.newBuilder(URI.create(authServerUrl + \"/.well-known/openid-configuration\")).GET().build(),\n    HttpResponse.BodyHandlers.ofString());\nif (resp.statusCode() != 200) throw new IllegalStateException(\"Discovery endpoint returned \" + resp.statusCode());","typeGuard":null,"tryCatchPattern":"try { startApp(); } catch (OidcEndpointAccessException e) {\n    log.errorf(\"OIDC discovery failed with status %d; check auth-server-url and provider availability\", e.statusCode());\n    // retry or fail fast\n}","preventionTips":["Curl the discovery URL from inside the deployment environment before release","Include the full realm path for Keycloak URLs","Set a generous quarkus.oidc.connection-delay for slow-starting providers","Import IdP TLS certificates into the truststore; check proxy/firewall rules"],"tags":["oidc","network","discovery","http"],"backgroundTag":"oidc-discovery-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}