quarkusio/quarkus · error · ConfigurationException

client-id, client-secret and introspection-url must be confi

Error message

client-id, client-secret and introspection-url must be configured when the oauth2 extension is enabled

What it means

The elytron-security-oauth2 extension validates tokens via an OAuth2 introspection endpoint. At static-init/build of the security realm, the recorder checks runtime config; if client-id, client-secret or introspection-url is missing it cannot build the introspection validator and throws a ConfigurationException.

Source

Thrown at extensions/elytron-security-oauth2/runtime/src/main/java/io/quarkus/elytron/security/oauth2/runtime/OAuth2Recorder.java:45

import io.quarkus.runtime.RuntimeValue;
import io.quarkus.runtime.annotations.Recorder;
import io.quarkus.runtime.configuration.ConfigurationException;

@Recorder
public class OAuth2Recorder {
    private final RuntimeValue<OAuth2RuntimeConfig> runtimeConfig;

    public OAuth2Recorder(final RuntimeValue<OAuth2RuntimeConfig> runtimeConfig) {
        this.runtimeConfig = runtimeConfig;
    }

    public RuntimeValue<SecurityRealm> createRealm()
            throws IOException, NoSuchAlgorithmException, CertificateException, KeyStoreException, KeyManagementException {
        OAuth2RuntimeConfig runtimeConfig = this.runtimeConfig.getValue();

        if (!runtimeConfig.clientId().isPresent() || !runtimeConfig.clientSecret().isPresent()
                || !runtimeConfig.introspectionUrl().isPresent()) {
            throw new ConfigurationException(
                    "client-id, client-secret and introspection-url must be configured when the oauth2 extension is enabled");
        }

        OAuth2IntrospectValidator.Builder validatorBuilder = OAuth2IntrospectValidator.builder()
                .clientId(runtimeConfig.clientId().get())
                .clientSecret(runtimeConfig.clientSecret().get())
                .tokenIntrospectionUrl(URI.create(runtimeConfig.introspectionUrl().get()).toURL());

        if (runtimeConfig.caCertFile().isPresent()) {
            validatorBuilder.useSslContext(createSSLContext(runtimeConfig));
        } else {
            validatorBuilder.useSslContext(SSLContext.getDefault());
        }

        if (runtimeConfig.connectionTimeout().isPresent()) {
            validatorBuilder.connectionTimeout((int) runtimeConfig.connectionTimeout().get().toMillis());
        }

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.elytron.security.oauth2.client-id, client-secret and introspection-url in application.properties or via environment variables
Remove the quarkus-elytron-security-oauth2 dependency if OAuth2 token validation is not actually used
Verify the active Quarkus profile resolves these properties (e.g. %prod prefix not applied in dev)

Example fix

// before (application.properties)
quarkus.elytron.security.oauth2.enabled=true
// after
quarkus.elytron.security.oauth2.enabled=true
quarkus.elytron.security.oauth2.client-id=my-client
quarkus.elytron.security.oauth2.client-secret=s3cr3t
quarkus.elytron.security.oauth2.introspection-url=https://idp.example.com/introspect

Defensive patterns

Strategy: validation

Validate before calling

if (!config.containsProperty("quarkus.elytron.security.oauth2.client-id") ||
    !config.containsProperty("quarkus.elytron.security.oauth2.client-secret") ||
    !config.containsProperty("quarkus.elytron.security.oauth2.introspection-url")) {
    throw new IllegalStateException("oauth2 realm requires client-id, client-secret and introspection-url");
}

Try / catch

try { /* app start */ } catch (ConfigurationException e) {
    log.error("oauth2 config incomplete: " + e.getMessage());
    throw e;
}

Prevention

Define all three oauth2 properties in application.properties before adding the extension
Use env vars consistently for secrets across environments
Fail fast with a startup config test in CI

When it happens

Trigger: quarkus.elytron.security.oauth2 extension is on the classpath but quarkus.elytron.security.oauth2.client-id, client-secret, or introspection-url is not set (or not resolvable from env vars/profiles).

Common situations: Added the extension but forgot config; config keys spelled wrong; secrets missing in the deployment environment; relying on a config profile that is not active.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2891ae5e4b4f8664. Report an issue: GitHub.