{"record":{"id":"fe2d864fc3a2ce0e","repo":"quarkusio/quarkus","slug":"oidcconfigurationmetadata-can-not-be-injected","errorCode":null,"errorMessage":"OidcConfigurationMetadata can not be injected","messagePattern":"OidcConfigurationMetadata can not be injected","errorType":"exception","errorClass":"OIDCException","httpStatus":500,"severity":"error","filePath":"extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcConfigurationAndProviderProducer.java","lineNumber":28,"sourceCode":"import io.quarkus.security.identity.SecurityIdentity;\n\n@RequestScoped\npublic class OidcConfigurationAndProviderProducer {\n    @Inject\n    TenantConfigBean tenantConfig;\n    @Inject\n    SecurityIdentity identity;\n\n    @Produces\n    @RequestScoped\n    OidcConfigurationMetadata produceMetadata() {\n        OidcConfigurationMetadata configMetadata = OidcUtils.getAttribute(identity, OidcUtils.CONFIG_METADATA_ATTRIBUTE);\n\n        if (configMetadata == null && tenantConfig.getDefaultTenant().oidcConfig().tenantEnabled()) {\n            configMetadata = tenantConfig.getDefaultTenant().provider().getMetadata();\n        }\n        if (configMetadata == null) {\n            throw new OIDCException(\"OidcConfigurationMetadata can not be injected\");\n        }\n        return configMetadata;\n    }\n\n    @Produces\n    @RequestScoped\n    OidcProviderClient produceProviderClient() {\n        OidcProviderClient client = null;\n        String tenantId = OidcUtils.getAttribute(identity, OidcUtils.TENANT_ID_ATTRIBUTE);\n        if (tenantId != null) {\n            if (OidcUtils.DEFAULT_TENANT_ID.equals(tenantId)) {\n                return tenantConfig.getDefaultTenant().getOidcProviderClient();\n            }\n            TenantConfigContext context = tenantConfig.getStaticTenant(tenantId);\n            if (context == null) {\n                context = tenantConfig.getDynamicTenant(tenantId);\n            }\n            if (context != null) {","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcConfigurationAndProviderProducer.java#L10-L46","documentation":"OidcConfigurationAndProviderProducer.produceMetadata() @Produces OidcConfigurationMetadata from the SecurityIdentity's CONFIG_METADATA_ATTRIBUTE, falling back to the default tenant's provider metadata. If neither is available, injection fails with OIDCException - the metadata is only present after successful authentication by the default (or identity-carrying) tenant.","triggerScenarios":"Inject OidcConfigurationMetadata in a bean during a request where the SecurityIdentity has no CONFIG_METADATA_ATTRIBUTE and either the default tenant is disabled (quarkus.oidc.tenant-enabled=false) or the identity was produced by a non-default/dynamic tenant without that attribute.","commonSituations":"Injecting OidcConfigurationMetadata in apps using only named tenants or TenantConfigResolver-based dynamic tenants with the default tenant disabled; using the injection outside authenticated request scope (e.g. startup, background thread).","solutions":["Enable the default tenant (quarkus.oidc.tenant-enabled=true) if your app actually authenticates against the default provider.","Don't inject OidcConfigurationMetadata directly; instead obtain metadata from the TenantConfigContext/provider for the tenant you care about, or read it from the SecurityIdentity attribute yourself with a null check.","Ensure injection happens only within an authenticated request (RequestScoped) and not during startup or scheduled tasks."],"exampleFix":"// before\n@Inject OidcConfigurationMetadata metadata; // fails when default tenant disabled\n\n// after - fetch from the specific tenant's provider\n@Inject TenantConfigBean tenantConfig;\nOidcConfigurationMetadata metadata =\n    tenantConfig.getStaticTenant(\"my-tenant\").getOidcProviderClient().getMetadata();","handlingStrategy":"try-catch","validationCode":"boolean canInjectMetadata = OidcUtils.getAttribute(identity, OidcUtils.CONFIG_METADATA_ATTRIBUTE) != null\n    || tenantConfig.getDefaultTenant().oidcConfig().tenantEnabled();","typeGuard":"boolean hasMetadata(SecurityIdentity identity, TenantConfigBean cfg) {\n    return OidcUtils.getAttribute(identity, OidcUtils.CONFIG_METADATA_ATTRIBUTE) != null\n        || cfg.getDefaultTenant().oidcConfig().tenantEnabled();\n}","tryCatchPattern":"try {\n    return metadataService.call();\n} catch (OIDCException e) {\n    if (e.getMessage().contains(\"OidcConfigurationMetadata\")) {\n        // resolve metadata from the specific tenant provider instead\n    }\n    throw e;\n}","preventionTips":["Don't keep quarkus.oidc.tenant-enabled=false if you inject default-tenant metadata","Inject only inside authenticated request scope","Fetch metadata from the tenant-specific provider when using named/dynamic tenants","Add null-safe attribute reads instead of direct @Inject where tenants vary"],"tags":["oidc","cdi","request-scoped","metadata"],"backgroundTag":"unavailable-cdi-dependency","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}