quarkusio/quarkus · error · ConfigurationException

'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIF

Error message

'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available. Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID, or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs from the SPIFFE Workload API

What it means

Thrown by OidcCommonUtils when the OIDC client is configured with credentials.jwt.source=spiffe-jwt but no SPIFFE JWT-SVID provider could be resolved. The provider is either an explicit token file via credentials.jwt.token-path or the quarkus-spiffe-client extension, which fetches SVIDs from the SPIFFE Workload API. Without one of these, the client cannot produce a JWT client assertion.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:1015

            if (clientAssertionProvider.getAvailableClientAssertion() == null) {
                LOG.warnf("Cannot find a valid %s token at path: %s, deferring token loading to request time",
                        jwtConfig.source() == Source.SPIFFE_JWT ? "SPIFFE JWT-SVID" : "JWT bearer",
                        jwtConfig.tokenPath().get());
            }
            return clientAssertionProvider;
        } else if (jwtConfig.source() == Source.SPIFFE_JWT) {
            var audience = jwtConfig.audience().or(() -> authServerUrl).orElseThrow(
                    () -> new ConfigurationException(
                            "'credentials.jwt.source' is set to 'spiffe-jwt', but no audience is available."
                                    + " Either set 'credentials.jwt.audience' or 'auth-server-url'"));
            var clientAssertionProvider = SpiffeClientAssertionProvider.forAudience(vertx, audience);
            if (clientAssertionProvider == null) {
                throw new ConfigurationException(
                        "'credentials.jwt.source' is set to 'spiffe-jwt', but no SPIFFE JWT-SVID provider is available."
                                + " Either set 'credentials.jwt.token-path' to a file containing the JWT-SVID,"
                                + " or add the 'quarkus-spiffe-client' extension to fetch JWT-SVIDs"
                                + " from the SPIFFE Workload API");
            }
            return clientAssertionProvider;
        }
        return null;
    }

    public static Object getClientAssertionTokenType(Source source) {
        return switch (source) {
            case BEARER, CLIENT -> "JWT bearer";
            case SPIFFE_JWT -> "SPIFFE JWT-SVID";
        };
    }

}

View on GitHub (pinned to e1c734241f)

Solutions

1. Add io.quarkus:quarkus-spiffe-client to fetch JWT-SVIDs from the SPIFFE Workload API
2. Set quarkus.oidc.credentials.jwt.token-path to a file containing a valid JWT-SVID
3. Verify the SPIFFE Workload API endpoint/socket is reachable so the extension can register a provider

Example fix

// before
quarkus.oidc.credentials.jwt.source=spiffe-jwt
// after
quarkus.oidc.credentials.jwt.source=spiffe-jwt
quarkus.oidc.credentials.jwt.token-path=/run/spire/agent/sockets/svid.jwt
# or add dependency: io.quarkus:quarkus-spiffe-client

if (config.getCredentials().getJwt().getSource() == OidcClientCommonConfig.Credentials.Jwt.Source.SPIFFE_JWT
        && (config.getCredentials().getJwt().getTokenPath().isEmpty()
            || !hasSpiffeClientExtension())) {
    throw new IllegalStateException("spiffe-jwt requires token-path or the quarkus-spiffe-client extension");
}

When it happens

Trigger: Setting quarkus.oidc.credentials.jwt.source=spiffe-jwt (or in an OidcClient config) without credentials.jwt.token-path, and without quarkus-spiffe-client on the classpath; calling getClientAssertionJwtSource where clientAssertionProvider is null.

Common situations: Copying SPIFFE config from docs/examples while forgetting to add the quarkus-spiffe-client dependency; migrating to SPIFFE auth in Kubernetes/Consul meshes where the Workload API socket path is wrong or extension missing; typo in token-path.

Related errors

• '%1$scredentials.jwt.source' is set to 'spiffe-jwt', but no
• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu
• Access token is required to check the roles but DefaultToken

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a934efe65639c327. Report an issue: GitHub.