quarkusio/quarkus · error · AuthenticationCompletionException

Authorization response 'iss' parameter is required but is no

Error message

Authorization response 'iss' parameter is required but is not present

What it means

If the OIDC provider's discovery metadata advertises authorization_response_iss_parameter_supported=true, the provider is required to include the 'iss' parameter in the authorization response. When the callback to the redirect_uri lacks the 'iss' parameter even though the metadata says it is supported, Quarkus treats the response as incomplete/possibly tampered and throws AuthenticationCompletionException.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java:931

    }

    private void validateAuthorizationResponseIssuer(MultiMap requestParams, TenantConfigContext configContext) {
        String expectedIssuer = configContext.getOidcMetadata().getIssuer();

        if (expectedIssuer == null || OidcProvider.ANY_ISSUER.equals(expectedIssuer)) {
            return;
        }

        String issParam = requestParams.get(OidcConstants.CODE_FLOW_ISSUER);

        if (issParam != null) {
            if (!issParam.equals(expectedIssuer)) {
                throw new AuthenticationCompletionException(String.format(
                        "Authorization response 'iss' parameter '%s' does not match the expected issuer '%s'",
                        issParam, expectedIssuer));
            }
        } else if (configContext.getOidcMetadata().isAuthorizationResponseIssParameterSupported()) {
            throw new AuthenticationCompletionException(
                    "Authorization response 'iss' parameter is required but is not present");
        }
    }

    private Uni<SecurityIdentity> performCodeFlow(IdentityProviderManager identityProviderManager,
            RoutingContext context, TenantConfigContext configContext, MultiMap requestParams,
            String[] parsedStateCookieValue) {

        String userPath = null;
        String userQuery = null;

        // This is an original redirect from IDP, check if the original request path and query need to be restored
        CodeAuthenticationStateBean stateBean = getCodeAuthenticationBean(parsedStateCookieValue, configContext);

        try {
            validateAuthorizationResponseIssuer(requestParams, configContext);
        } catch (AuthenticationCompletionException ex) {
            LOG.error(ex.getMessage());

View on GitHub (pinned to e1c734241f)

Solutions

Check proxy/gateway/filter configuration so that all query parameters, including 'iss', survive the redirect back to the redirect_uri.
Verify the actual authorization response URL (enable quarkus.oidc logs) and confirm whether iss is present.
If the provider does not actually send iss, fix/upgrade the provider or disable iss enforcement in metadata handling.
Ensure the redirect_uri matches exactly what is registered so the callback carries the full original query string.

Example fix

// before (nginx rewrite dropping params)
proxy_pass http://app/callback?code=$arg_code;
// after
proxy_pass http://app/$request_uri;

Defensive patterns

Strategy: validation

Validate before calling

// Check that the callback URL retained all query parameters
if (metadata.isAuthorizationResponseIssParameterSupported()
        && !callbackUri.getQuery().contains("iss=")) {
    log.warn("Provider advertises iss support but callback lacks 'iss'; check proxies/redirect handling");
}

Try / catch

try {
    return completeAuthentication(callbackParams);
} catch (AuthenticationCompletionException e) {
    if (e.getMessage() != null && e.getMessage().contains("'iss' parameter is required but is not present")) {
        log.error("'iss' stripped from authorization response; inspect proxy/gateway rewrite rules");
    }
    throw e;
}

Prevention

Do not strip or rewrite query parameters on the callback route in proxies/CDNs.
Test the full code flow behind any reverse proxy before production.
Pin/verify provider metadata matches actual provider behavior; upgrade provider if metadata lies.

When it happens

Trigger: configContext.getOidcMetadata().isAuthorizationResponseIssParameterSupported() is true but requestParams.get(CODE_FLOW_ISSUER) is null in the code flow callback handling.

Common situations: A reverse proxy or gateway strips unknown query parameters (like iss) from the redirect back to the app; provider metadata over-declares iss support while its actual responses omit it; older provider version behind a newer discovery document.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/eec49de9071f6e13. Report an issue: GitHub.