{"record":{"id":"c3544923c707a6fe","repo":"quarkusio/quarkus","slug":"username-and-password-must-be-set-when-a-password","errorCode":null,"errorMessage":"Username and password must be set when a password grant is used","messagePattern":"Username and password must be set when a password grant is used","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientRecorder.java","lineNumber":185,"sourceCode":"        MultiMap tokenGrantParams = null;\n\n        if (oidcConfig.grant().type() != Grant.Type.REFRESH) {\n            tokenGrantParams = MultiMap.caseInsensitiveMultiMap();\n            setGrantClientParams(oidcConfig, tokenGrantParams, grantType);\n\n            if (oidcConfig.grantOptions() != null) {\n                Map<String, String> grantOptions = oidcConfig.grantOptions()\n                        .get(oidcConfig.grant().type().name().toLowerCase());\n                if (grantOptions != null) {\n                    if (oidcConfig.grant().type() == Grant.Type.PASSWORD) {\n                        // Without this block `password` will be listed first, before `username`\n                        // which is not a technical problem but might affect Wiremock tests or the endpoints\n                        // which expect a specific order.\n                        final String userName = grantOptions.get(OidcConstants.PASSWORD_GRANT_USERNAME);\n                        final String userPassword = grantOptions.get(OidcConstants.PASSWORD_GRANT_PASSWORD);\n                        if (userName == null || userPassword == null) {\n                            client.close();\n                            throw new ConfigurationException(\n                                    \"Username and password must be set when a password grant is used\",\n                                    Set.of(\"quarkus.oidc-client.grant.type\",\n                                            \"quarkus.oidc-client.grant-options\"));\n                        }\n                        tokenGrantParams.add(OidcConstants.PASSWORD_GRANT_USERNAME, userName);\n                        tokenGrantParams.add(OidcConstants.PASSWORD_GRANT_PASSWORD, userPassword);\n                        for (Map.Entry<String, String> entry : grantOptions.entrySet()) {\n                            if (!OidcConstants.PASSWORD_GRANT_USERNAME.equals(entry.getKey())\n                                    && !OidcConstants.PASSWORD_GRANT_PASSWORD.equals(entry.getKey())) {\n                                tokenGrantParams.add(entry.getKey(), entry.getValue());\n                            }\n                        }\n                    } else {\n                        tokenGrantParams.addAll(grantOptions);\n                    }\n                }\n                if (oidcConfig.grant().type() == Grant.Type.EXCHANGE\n                        && !tokenGrantParams.contains(OidcConstants.EXCHANGE_GRANT_SUBJECT_TOKEN_TYPE)) {","sourceCodeStart":167,"sourceCodeEnd":203,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientRecorder.java#L167-L203","documentation":"When quarkus.oidc-client.grant.type=password, the token request requires grant-options entries for username and password. OidcClientRecorder.createOidcClientUniFromMetadata closes the client and throws a ConfigurationException listing the offending properties when either is missing.","triggerScenarios":"Configuring grant.type=password without quarkus.oidc-client.grant-options.password.username and quarkus.oidc-client.grant-options.password.password — detected during client creation from metadata.","commonSituations":"Setting grant.type=password but forgetting grant-options; placing username/password at the wrong config level (not under grant-options); YAML/properties indentation errors hiding the options; secrets not injected in the active profile.","solutions":["Set quarkus.oidc-client.grant-options.password.username and quarkus.oidc-client.grant-options.password.password","Confirm grant.type=password is actually intended; otherwise switch grant.type","Check property nesting under the correct named-client prefix","Verify secrets resolve in the active profile (env vars, vault, etc.)"],"exampleFix":"# before\nquarkus.oidc-client.grant.type=password\n\n# after\nquarkus.oidc-client.grant.type=password\nquarkus.oidc-client.grant-options.password.username=alice\nquarkus.oidc-client.grant-options.password.password=secret","handlingStrategy":"validation","validationCode":"if (GrantType.PASSWORD.equals(config.grant().type())) {\n    var opts = config.grantOptions().password();\n    if (opts.username().isEmpty() || opts.password().isEmpty()) throw new IllegalArgumentException(\"password grant requires username and password grant-options\");\n}","typeGuard":null,"tryCatchPattern":"try { return client.getTokens().await().indefinitely(); } catch (ConfigurationException e) { if (e.getMessage().contains(\"Username and password must be set\")) { throw new IllegalStateException(\"Configure grant-options.password.username/password\", e); } throw e; }","preventionTips":["Configure username/password under quarkus.oidc-client.grant-options.password.*","Externalize the password via env var or config secret reference","Validate client config with a smoke test at startup"],"tags":["oidc","config","password-grant"],"backgroundTag":"missing-required-config-property","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}