{"record":{"id":"fcacf4296e83c749","repo":"quarkusio/quarkus","slug":"invalid-tenant-id","errorCode":null,"errorMessage":"Invalid tenant id","messagePattern":"Invalid tenant id","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/SessionExpiredOidcRedirectFilter.java","lineNumber":27,"sourceCode":"import io.quarkus.oidc.OidcRedirectFilter;\nimport io.quarkus.oidc.Redirect;\nimport io.quarkus.oidc.Redirect.Location;\nimport io.quarkus.oidc.TenantFeature;\nimport io.quarkus.oidc.common.runtime.OidcCommonUtils;\nimport io.quarkus.oidc.runtime.OidcUtils;\nimport io.smallrye.jwt.build.Jwt;\n\n@ApplicationScoped\n@Unremovable\n@TenantFeature(\"tenant-refresh\")\n@Redirect(Location.SESSION_EXPIRED_PAGE)\npublic class SessionExpiredOidcRedirectFilter implements OidcRedirectFilter {\n\n    @Override\n    public void filter(OidcRedirectContext context) {\n\n        if (!\"tenant-refresh\".equals(context.oidcTenantConfig().tenantId.get())) {\n            throw new RuntimeException(\"Invalid tenant id\");\n        }\n\n        if (!context.redirectUri().contains(\"/session-expired-page\")) {\n            throw new RuntimeException(\"Invalid redirect URI\");\n        }\n\n        AuthorizationCodeTokens tokens = context.routingContext().get(AuthorizationCodeTokens.class.getName());\n        String userName = OidcCommonUtils.decodeJwtContent(tokens.getIdToken()).getString(Claims.preferred_username.name());\n        String jwe = Jwt.preferredUserName(userName).jwe()\n                .encryptWithSecret(context.oidcTenantConfig().credentials.secret.get());\n        OidcUtils.createCookie(context.routingContext(), context.oidcTenantConfig(), \"session_expired\",\n                jwe + \"|\" + context.oidcTenantConfig().tenantId.get(), 10);\n\n        context.additionalQueryParams().add(\"session-expired\", \"true\");\n    }\n\n}\n","sourceCodeStart":9,"sourceCodeEnd":45,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/SessionExpiredOidcRedirectFilter.java#L9-L45","documentation":"SessionExpiredOidcRedirectFilter filters OIDC redirects and validates that the redirect belongs to the 'tenant-refresh' tenant. When the OIDC tenant id in the redirect context is anything else, it throws to fail fast, since the filter was designed exclusively for the tenant-refresh session-expired flow.","triggerScenarios":"The filter is registered globally (via @OidcRedirectFilter or config) and an OIDC redirect is produced for a tenant other than 'tenant-refresh'.","commonSituations":"Multiple OIDC tenants configured but the filter not scoped to one tenant; filter class picked up for all redirects; renaming tenant ids in application.properties without updating the filter.","solutions":["Scope the filter to the intended tenant (e.g. register it only for tenant-refresh via tenant-specific configuration)","Update the tenant-id comparison to match the actual configured tenant id","Verify quarkus.oidc.<tenant>.tenant-id in application.properties matches 'tenant-refresh'"],"exampleFix":"// before\nif (!\"tenant-refresh\".equals(context.oidcTenantConfig().tenantId.get())) {\n    throw new RuntimeException(\"Invalid tenant id\");\n}\n// after\nif (!\"tenant-refresh\".equals(context.oidcTenantConfig().tenantId.get())) {\n    // skip instead of failing for other tenants\n    return;\n}","handlingStrategy":"validation","validationCode":"String tenantId = context.oidcTenantConfig().tenantId.get();\nif (!\"tenant-refresh\".equals(tenantId)) {\n    return; // skip unrelated tenants instead of throwing\n}","typeGuard":null,"tryCatchPattern":"try {\n    redirectFilter.filter(context);\n} catch (RuntimeException e) {\n    if (e.getMessage().equals(\"Invalid tenant id\")) {\n        // filter applied to wrong tenant; scope its registration\n    }\n}","preventionTips":["Scope OidcRedirectFilter registration to the intended tenant","Keep tenant ids in application.properties in sync with filter checks","Add a test covering redirects from other tenants"],"tags":["oidc","tenant","redirect-filter"],"backgroundTag":"invalid-tenant-id","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}