{"record":{"id":"e3db3323c29c79eb","repo":"quarkusio/quarkus","slug":"openid-connect-provider-token-endpoint-url-is-not","errorCode":null,"errorMessage":"OpenId Connect Provider token endpoint URL is not configured and can not be discovered","messagePattern":"OpenId Connect Provider token endpoint URL is not configured and can not be discovered","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java","lineNumber":521,"sourceCode":"            Function<ClientCredentials, Uni<OidcConfigurationMetadata>> metadataResolver, String grantType,\n            MultiMap tokenGrantParams, MultiMap commonRefreshGrantParams, OidcClientConfig oidcClientConfig,\n            Map<OidcEndpoint.Type, List<OidcRequestFilter>> requestFilters,\n            Map<OidcEndpoint.Type, List<OidcResponseFilter>> responseFilters, Vertx vertx) {\n        final boolean jwtAssertionProvided = oidcClientConfig.credentials().jwt().source() != Source.CLIENT;\n        final ClientAssertionProvider assertionProvider = getClientAssertionProvider(vertx, oidcClientConfig.credentials(),\n                oidcClientConfig.authServerUrl());\n        return OidcCommonUtils.clientSecret(oidcClientConfig.credentials())\n                .onItem().ifNotNull()\n                .transform(clientSecret -> new ClientCredentials(null, clientSecret,\n                        OidcCommonUtils.initClientSecretBasicAuth(oidcClientConfig, clientSecret),\n                        jwtAssertionProvided, assertionProvider))\n                .onItem().ifNull()\n                .switchTo(() -> OidcCommonUtils.initClientJwtKey(oidcClientConfig)\n                        .map(key -> new ClientCredentials(key, null, null, jwtAssertionProvided, assertionProvider)))\n                .<OidcClient> flatMap(clientCredentials -> metadataResolver.apply(clientCredentials)\n                        .map(metadata -> {\n                            if (metadata == null || metadata.tokenRequestUri == null) {\n                                throw new ConfigurationException(\n                                        \"OpenId Connect Provider token endpoint URL is not configured and can not be discovered\");\n                            }\n                            return new OidcClientImpl(client, metadata.tokenRequestUri, metadata.tokenRevokeUri, grantType,\n                                    tokenGrantParams,\n                                    commonRefreshGrantParams, oidcClientConfig, requestFilters, responseFilters, vertx,\n                                    clientCredentials);\n                        }))\n                .onFailure().invoke(t -> {\n                    LOG.error(\"Failed to create OidcClientImpl\", t);\n                    if (t instanceof ConfigurationException) {\n                        client.close();\n                    }\n                });\n    }\n\n    record ClientCredentials(Key clientJwtKey, String clientSecret, String clientSecretBasicAuthScheme,\n            boolean jwtAssertionProvided, ClientAssertionProvider clientAssertionProvider) {\n    }","sourceCodeStart":503,"sourceCodeEnd":539,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java#L503-L539","documentation":"During OIDC client initialization (OidcClientImpl.of), the metadata resolution must yield a token endpoint URL. This ConfigurationException is thrown when the OIDC discovery metadata is null or contains no token_request_uri, meaning the provider's token endpoint could be neither configured directly nor discovered.","triggerScenarios":"Creating an OidcClient via OidcClientImpl.of / OidcClients.newClient where neither discovery metadata provides a token endpoint nor is the token path configured; discovery enabled but provider's .well-known/openid-configuration lacks token_endpoint; discovery URL unreachable returning empty metadata.","commonSituations":"Pointing auth-server-url at a provider that does not publish discovery metadata; misconfigured discovery URL returning 404; disabling discovery but forgetting to set token-path; network/proxy blocking metadata fetch.","solutions":["Set an absolute quarkus.oidc-client.token-path explicitly","Verify auth-server-url points to a reachable provider with discovery metadata containing token_endpoint","If discovery is disabled, ensure token-path is set","Check network/proxy availability of the provider's .well-known endpoint"],"exampleFix":"# before\nquarkus.oidc-client.auth-server-url=http://localhost:8180/realms/test\n# provider without discovery\n\n# after\nquarkus.oidc-client.auth-server-url=http://localhost:8180/realms/test\nquarkus.oidc-client.token-path=http://localhost:8180/realms/test/protocol/openid-connect/token","handlingStrategy":"validation","validationCode":"if ((config.authServerUrl().isEmpty() || !isDiscoveryReachable(config.authServerUrl().get())) && !isAbsolute(config.tokenPath())) {\n    throw new IllegalArgumentException(\"Provide token-path or ensure discovery metadata contains token_endpoint\");\n}","typeGuard":"boolean hasTokenEndpoint(OidcClientConfig c) {\n    return OidcCommonUtils.isAbsoluteUrl(c.tokenPath()) || c.authServerUrl().isPresent();\n}","tryCatchPattern":"try { client = oidcClients.newClient(config).await().indefinitely(); } catch (ConfigurationException e) { if (e.getMessage().contains(\"token endpoint URL is not configured\")) { config = withExplicitTokenPath(config); client = oidcClients.newClient(config).await().indefinitely(); } else throw e; }","preventionTips":["Verify the provider publishes .well-known/openid-configuration with token_endpoint","Set token-path explicitly when discovery is unavailable","Test metadata fetch from the deployment network (proxy/firewall)"],"tags":["oidc","config","discovery","token-endpoint"],"backgroundTag":"token-endpoint-not-configured","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}