quarkusio/quarkus · error · ConfigurationException

Configuration property 'quarkus.rest-client-oidc-token-propa

Error message

Configuration property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to 'true', however this configuration property is only supported when either 'quarkus-oidc' or 'quarkus-smallrye-jwt' extensions are present.

What it means

This build-time error is thrown by the reactive OIDC token propagation extension when the property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to true, but neither 'quarkus-oidc' nor 'quarkus-smallrye-jwt' is on the classpath. Token propagation works by wiring a TokenCredential produced during authentication into the duplicated context; without one of those authentication extensions there is nothing producing that credential, so the configuration is invalid and the build fails fast via a ConfigurationException.

Source

Thrown at extensions/oidc-token-propagation-reactive/deployment/src/main/java/io/quarkus/oidc/token/propagation/reactive/deployment/OidcTokenPropagationReactiveBuildStep.java:87

        additionalBeans.produce(AdditionalBeanBuildItem.unremovableOf(AccessTokenRequestReactiveFilter.class));
        reflectiveClass.produce(ReflectiveClassBuildItem.builder(AccessTokenRequestReactiveFilter.class.getName())
                .reason(getClass().getName())
                .methods().fields().build());
        additionalIndexedClassesBuildItem
                .produce(new AdditionalIndexedClassesBuildItem(AccessTokenRequestReactiveFilter.class.getName()));
    }

    @BuildStep(onlyIf = IsEnabledDuringAuth.class)
    SystemPropertyBuildItem activateTokenCredentialPropagationViaDuplicatedContext(Capabilities capabilities) {
        if (capabilities.isPresent(Capability.OIDC)) {
            return new SystemPropertyBuildItem(OIDC_PROPAGATE_TOKEN_CREDENTIAL, "true");
        }

        if (capabilities.isPresent(Capability.JWT)) {
            return new SystemPropertyBuildItem(JWT_PROPAGATE_TOKEN_CREDENTIAL, "true");
        }

        throw new ConfigurationException(
                "Configuration property 'quarkus.rest-client-oidc-token-propagation.enabled-during-authentication' is set to " +
                        "'true', however this configuration property is only supported when either 'quarkus-oidc' or " +
                        "'quarkus-smallrye-jwt' extensions are present.");
    }

    public static class IsEnabled implements BooleanSupplier {
        OidcTokenPropagationReactiveBuildTimeConfig config;

        public boolean getAsBoolean() {
            return config.enabled();
        }
    }

    public static class IsEnabledDuringAuth implements BooleanSupplier {
        OidcTokenPropagationReactiveBuildTimeConfig config;

        public boolean getAsBoolean() {
            return config.enabledDuringAuthentication();

View on GitHub (pinned to e1c734241f)

Solutions

1. Add 'quarkus-oidc' (or 'quarkus-smallrye-jwt') as a dependency so tokens are actually produced during authentication
2. If you do not authenticate requests, remove quarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true from configuration
3. Use quarkus.rest-client-oidc-token-propagation instead (propagate the current access token directly) if that matches your intent

Example fix

// before (pom.xml lacks auth extension, application.properties)
quarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true
// after (pom.xml)
<dependency>
  <groupId>io.quarkus</groupId>
  <artifactId>quarkus-oidc</artifactId>
</dependency>

boolean enabled = ConfigProvider.getConfig()
    .getOptionalValue("quarkus.rest-client-oidc-token-propagation.enabled-during-authentication", Boolean.class)
    .orElse(false);
if (enabled) {
    Class.forName("io.quarkus.oidc.Oidc", false, Thread.currentThread().getContextClassLoader());
    // or check for io.smallrye.jwt.* if using quarkus-smallrye-jwt
}

try {
    startApp();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("enabled-during-authentication")) {
        throw new IllegalStateException("Add quarkus-oidc or quarkus-smallrye-jwt, or disable token propagation", e);
    }
    throw e;
}

When it happens

Trigger: An application sets quarkus.rest-client-oidc-token-propagation.enabled-during-authentication=true (or defaults it via java.security.Principal injection support) in application.properties while only having quarkus-rest-client-* and quarkus-oidc-token-propagation-reactive dependencies, with no OIDC or smallrye-jwt extension present. Thrown from activateTokenCredentialPropagationViaDuplicatedContext during static init of the build.

Common situations: Copying a REST client configuration from a project that also used quarkus-oidc; removing quarkus-oidc during a refactor but keeping token propagation config; relying on plain Keycloak/RestClient without adding the auth extension; upgrading and the OIDC dependency was dropped from the BOM.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The configuration ${clazz} is missing the @ConfigRoot annota
• Invalid configuration value set for 'quarkus.arc.remove-unus
• Hibernate Envers activated explicitly for persistence unit '
• The FastbootHibernateProvider PersistenceProvider can not su
• Hibernate ORM activated explicitly for persistence unit '<pu

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/22f3497d9ba35315. Report an issue: GitHub.