quarkusio/quarkus · error · ConfigurationException

Configuration property 'quarkus.resteasy-client-oidc-token-p

Error message

Configuration property 'quarkus.resteasy-client-oidc-token-propagation.enabled-during-authentication' is set to 'true', however this configuration property is only supported when either 'quarkus-oidc' or 'quarkus-smallrye-jwt' extensions are present.

What it means

OidcTokenPropagationBuildStep.activateTokenCredentialPropagationViaDuplicatedContext requires quarkus-oidc or quarkus-smallrye-jwt to honor enabled-during-authentication: only those extensions know how to authenticate requests and expose a propagated token credential. With neither present the configuration is invalid and a ConfigurationException is thrown.

Source

Thrown at extensions/oidc-token-propagation/deployment/src/main/java/io/quarkus/oidc/token/propagation/deployment/OidcTokenPropagationBuildStep.java:90

                }
                reflectiveClass.produce(ReflectiveClassBuildItem.builder(forReflection)
                        .reason(getClass().getName())
                        .methods().fields().constructors().build());
            }
        }
    }

    @BuildStep(onlyIf = IsEnabledDuringAuth.class)
    SystemPropertyBuildItem activateTokenCredentialPropagationViaDuplicatedContext(Capabilities capabilities) {
        if (capabilities.isPresent(Capability.OIDC)) {
            return new SystemPropertyBuildItem(OIDC_PROPAGATE_TOKEN_CREDENTIAL, "true");
        }

        if (capabilities.isPresent(Capability.JWT)) {
            return new SystemPropertyBuildItem(JWT_PROPAGATE_TOKEN_CREDENTIAL, "true");
        }

        throw new ConfigurationException(
                "Configuration property 'quarkus.resteasy-client-oidc-token-propagation.enabled-during-authentication' is set to "
                        +
                        "'true', however this configuration property is only supported when either 'quarkus-oidc' or " +
                        "'quarkus-smallrye-jwt' extensions are present.");
    }

    public static class IsEnabled implements BooleanSupplier {
        OidcTokenPropagationBuildTimeConfig config;

        public boolean getAsBoolean() {
            return config.enabled();
        }
    }

    public static class IsEnabledDuringAuth implements BooleanSupplier {
        OidcTokenPropagationBuildTimeConfig config;

        public boolean getAsBoolean() {

View on GitHub (pinned to e1c734241f)

Solutions

1. Add io.quarkus:quarkus-oidc or io.quarkus:quarkus-smallrye-jwt to the application
2. Set quarkus.resteasy-client-oidc-token-propagation.enabled-during-authentication=false or remove it
3. If you only need plain token propagation, use the default (non-authentication) propagation mode

Example fix

// before
quarkus.resteasy-client-oidc-token-propagation.enabled-during-authentication=true
# no oidc/jwt extension
// after
add <dependency>io.quarkus:quarkus-oidc</dependency>
# or set the property to false

boolean hasOidcOrJwt = classpathContains("io.quarkus:quarkus-oidc")
        || classpathContains("io.quarkus:quarkus-smallrye-jwt");
if (config.enabledDuringAuthentication() && !hasOidcOrJwt) {
    throw new IllegalStateException("enabled-during-authentication requires quarkus-oidc or quarkus-smallrye-jwt");
}

When it happens

Trigger: Setting quarkus.resteasy-client-oidc-token-propagation.enabled-during-authentication=true while neither Capability.OIDC nor Capability.JWT is present in the app.

Common situations: Enabling token propagation during authentication in a REST client app without any OIDC or JWT extension; removing quarkus-oidc/quarkus-smallrye-jwt but keeping the property set.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu
• Access token is required to check the roles but DefaultToken
• UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/3f560ce518c958ef. Report an issue: GitHub.