{"record":{"id":"cd3cd8f1863cbb83","repo":"quarkusio/quarkus","slug":"dynamic-tenant-id-cannot-be-same-as-the-default-te","errorCode":null,"errorMessage":"Dynamic tenant ID cannot be same as the default tenant ID: %s","messagePattern":"Dynamic tenant ID cannot be same as the default tenant ID: (.+?)","errorType":"validation","errorClass":"io.quarkus.runtime.configuration.ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java","lineNumber":88,"sourceCode":"        var defaultTenantInitializer = createStaticTenantContextCreator(defaultTenant, foundNamedStaticTenants,\n                defaultTenantId);\n        return createStaticTenantContext(defaultTenant, foundNamedStaticTenants, defaultTenantId, defaultTenantInitializer);\n    }\n\n    Map<String, TenantConfigContext> createStaticTenantConfigs(Map<String, OidcTenantConfig> staticTenants,\n            OidcTenantConfig defaultTenant) {\n        final String defaultTenantId = defaultTenant.tenantId().get();\n        Map<String, TenantConfigContext> staticTenantsConfig = new HashMap<>();\n        for (var tenant : staticTenants.entrySet()) {\n            createStaticTenantConfig(defaultTenantId, tenant.getKey(), tenant.getValue(), staticTenantsConfig);\n        }\n        return Map.copyOf(staticTenantsConfig);\n    }\n\n    Uni<TenantConfigContext> createDynamic(OidcTenantConfig oidcConfig) {\n        var tenantId = oidcConfig.tenantId().orElseThrow();\n        if (OidcUtils.DEFAULT_TENANT_ID.equals(tenantId)) {\n            throw new ConfigurationException(\"Dynamic tenant ID cannot be same as the default tenant ID: \" + tenantId);\n        }\n        return createTenantContext(oidcConfig, false, tenantId)\n                .onFailure().transform(new Function<Throwable, Throwable>() {\n                    @Override\n                    public Throwable apply(Throwable t) {\n                        return logTenantConfigContextFailure(t, tenantId);\n                    }\n                });\n    }\n\n    private void createStaticTenantConfig(String defaultTenantId, String tenantKey, OidcTenantConfig namedTenantConfig,\n            Map<String, TenantConfigContext> staticTenantsConfig) {\n        OidcCommonUtils.verifyConfigurationId(defaultTenantId, tenantKey, namedTenantConfig.tenantId());\n        var staticTenantInitializer = createStaticTenantContextCreator(namedTenantConfig, false, tenantKey);\n        staticTenantsConfig.put(tenantKey,\n                createStaticTenantContext(namedTenantConfig, false, tenantKey, staticTenantInitializer));\n    }\n","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java#L70-L106","documentation":"Quarkus OIDC reserves the tenant ID \"default\" for the built-in default tenant. When an application creates a dynamic tenant (e.g. via OidcTenantConfigResolver or programmatically), its ID must differ from the default tenant ID, otherwise tenant lookup would be ambiguous. TenantContextFactory.createDynamic rejects such a configuration at startup by throwing this ConfigurationException.","triggerScenarios":"Calling TenantContextFactory.createDynamic(oidcConfig) where oidcConfig.tenantId() resolves to OidcUtils.DEFAULT_TENANT_ID (\"default\") — e.g. a TenantConfigResolver returning a config with tenant-id \"default\", or programmatic tenant registration that reuses the default ID.","commonSituations":"Writing an OidcTenantConfigResolver that copies tenant-id from a request path/header which happens to be \"default\"; migrating a static named tenant into a dynamic resolver but forgetting to rename it; copy-pasting tenant config builder code and leaving tenant-id(\"default\") in place.","solutions":["Change the dynamic tenant's tenant-id to any value other than \"default\" (e.g. set .tenantId(\"acme\")).","If the tenant really is the default one, move its settings into quarkus.oidc.* properties (the static default tenant) instead of a dynamic config.","If the ID comes from user input (path/header), validate or reject the value \"default\" before building the OidcTenantConfig."],"exampleFix":"// before\nOidcTenantConfig config = OidcTenantConfig.fromName(\"default\"); // passed to resolver\n\n// after\nOidcTenantConfig config = OidcTenantConfig.fromName(\"acme\");","handlingStrategy":"validation","validationCode":"String tenantId = config.tenantId().orElseThrow();\nif (\"default\".equals(tenantId)) {\n    throw new IllegalArgumentException(\"Dynamic tenant id must differ from 'default'\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hardcode \"default\" as a tenant-id in resolvers or programmatic tenant creation.","Sanitize tenant IDs derived from request data to reject reserved values.","Keep dynamic tenant naming in one constants/utility class."],"tags":["oidc","configuration","tenant-id","startup"],"backgroundTag":"duplicate-tenant-identifier","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}