{"record":{"id":"d64895b3e5951d69","repo":"quarkusio/quarkus","slug":"key-is-null","errorCode":null,"errorMessage":"Key is null","messagePattern":"Key is null","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java","lineNumber":542,"sourceCode":"\n                    if (creds.jwt().keyStorePassword().isPresent()) {\n                        ks.load(is, creds.jwt().keyStorePassword().get().toCharArray());\n                    } else {\n                        ks.load(is, null);\n                    }\n\n                    if (creds.jwt().keyPassword().isPresent()) {\n                        key = ks.getKey(creds.jwt().keyId().get(), creds.jwt().keyPassword().get().toCharArray());\n                    } else {\n                        throw new ConfigurationException(\n                                \"When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set\");\n                    }\n                }\n            } catch (Exception ex) {\n                throw new ConfigurationException(\"Key can not be loaded\", ex);\n            }\n            if (key == null) {\n                throw new ConfigurationException(\"Key is null\");\n            }\n            return Uni.createFrom().item(key);\n        }\n    }\n\n    public static String signJwtWithKey(OidcClientCommonConfig oidcConfig, String tokenRequestUri, Key key) {\n        // 'jti' and 'iat' claims are created by default, 'iat' - is set to the current time\n        JwtSignatureBuilder jwtSignatureBuilder = Jwt\n                .claims(additionalClaims(oidcConfig.credentials().jwt().claims()))\n                .issuer(oidcConfig.credentials().jwt().issuer().orElse(oidcConfig.clientId().get()))\n                .subject(oidcConfig.credentials().jwt().subject().orElse(oidcConfig.clientId().get()))\n                .audience(oidcConfig.credentials().jwt().audience().isPresent()\n                        ? removeAudienceTrailingSlash(oidcConfig.credentials().jwt(),\n                                oidcConfig.credentials().jwt().audience().get())\n                        : tokenRequestUri)\n                .expiresIn(oidcConfig.credentials().jwt().lifespan()).jws();\n        if (oidcConfig.credentials().jwt().tokenKeyId().isPresent()) {\n            jwtSignatureBuilder.keyId(oidcConfig.credentials().jwt().tokenKeyId().get());","sourceCodeStart":524,"sourceCodeEnd":560,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java#L524-L560","documentation":"After loading JWT credentials, the resolved Key object was still null — the configured key store did not yield a key (e.g. no alias match or empty key reference) yet no exception was thrown during loading. Quarkus treats a null key as a configuration error.","triggerScenarios":"clientJwtKey finishes without exception but 'key' remains null, e.g. the key store entry/alias does not exist, or no key source (key, key-file, key-store-file) actually produced a key while JWT auth was required.","commonSituations":"key-store-file present but credentials.jwt.key-id (alias) does not match any entry; alias pointing to a certificate entry rather than a private key entry; JWT auth triggered by partial config but the actual key property was mistyped.","solutions":["Set credentials.jwt.key-id (or key alias) to the exact alias of the PrivateKey entry in the key store","Verify with 'keytool -list -keystore keystore.jks' that the alias exists and is a PrivateKeyEntry","Ensure one complete key source is configured: credentials.jwt.key (inline secret), key-file (PEM), or key-store-file + key-password + key-id","Remove stale/empty JWT credential properties that trigger JWT auth without a key"],"exampleFix":"// before\nquarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks\nquarkus.oidc-client.credentials.jwt.key-id=wrongAlias\n// after\nquarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks\nquarkus.oidc-client.credentials.jwt.key-id=mySigningKey\nquarkus.oidc-client.credentials.jwt.key-password=keypass","handlingStrategy":"validation","validationCode":"// pre-check alias resolves to a private key\ntry (InputStream is = new FileInputStream(\"keystore.jks\")) {\n    KeyStore ks = KeyStore.getInstance(\"JKS\");\n    ks.load(is, storePassword.toCharArray());\n    if (ks.getKey(alias, keyPassword.toCharArray()) == null) {\n        throw new IllegalStateException(\"Alias \" + alias + \" has no private key\");\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Run 'keytool -list -keystore' and confirm the alias exists as PrivateKeyEntry","Keep key-id/alias in sync with key store contents via CI checks","Configure exactly one complete JWT key source (key, key-file, or key-store trio)"],"tags":["oidc","keystore","jwt","config"],"backgroundTag":"key-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}