quarkusio/quarkus · error · ConfigurationException

Currently only 'service' applications can be used to verify

Error message

Currently only 'service' applications can be used to verify tokens with inlined certificate chains

What it means

Quarkus OIDC throws this when a tenant is configured to verify tokens whose certificate chains are inlined (e.g. 'certificate-chain' public key verification), but the tenant is not a 'service' application. Certificate-chain verification is only implemented for bearer-token service apps without an OIDC server; web-app/code-flow tenants are rejected at tenant context creation time during startup.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:403

        } else {
            oidcConfig.authentication.setUserInfoRequired(true);
        }
        return true;
    }

    private Uni<TenantConfigContext> createTenantContextFromPublicKey(OidcTenantConfig oidcConfig) {
        if (!OidcUtils.isServiceApp(oidcConfig)) {
            throw new ConfigurationException("'public-key' property can only be used with the 'service' applications");
        }
        LOG.debug("'public-key' property for the local token verification is set,"
                + " no connection to the OIDC server will be created");

        return TenantConfigContext.createReady(new OidcProvider(oidcConfig.publicKey().get(), oidcConfig), oidcConfig);
    }

    private Uni<TenantConfigContext> createTenantContextToVerifyCertChain(OidcTenantConfig oidcConfig) {
        if (!OidcUtils.isServiceApp(oidcConfig)) {
            throw new ConfigurationException(
                    "Currently only 'service' applications can be used to verify tokens with inlined certificate chains");
        }

        return TenantConfigContext.createReady(new OidcProvider(null, oidcConfig), oidcConfig);
    }

    private OIDCException toOidcException(Throwable cause, String authServerUrl, String tenantId) {
        final String message = OidcCommonUtils.formatConnectionErrorMessage(authServerUrl);
        LOG.warn(message);
        fireOidcServerNotAvailableEvent(authServerUrl, tenantId);
        return new OIDCException("OIDC Server is not available", cause);
    }

    private Uni<OidcProvider> createOidcProvider(OidcTenantConfig oidcConfig) {
        return createOidcClientUni(oidcConfig)
                .flatMap(new Function<OidcProviderClientImpl, Uni<? extends OidcProvider>>() {
                    @Override
                    public Uni<OidcProvider> apply(OidcProviderClientImpl client) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Make the tenant a pure 'service' application: remove auth-server-url / code-flow settings so OidcUtils.isServiceApp returns true (application-type=service, no authentication mechanism redirection).
2. Switch token verification to a different strategy (e.g. verify with the OIDC server via jwks) if the tenant must remain a web-app.
3. If you truly need certificate-chain verification for a web-app tenant, split it into a separate service-type tenant configured with quarkus.oidc.tenant-<name>.application-type=service.

Example fix

// before
quarkus.oidc.tenant-b.auth-server-url=https://idp.example.com
quarkus.oidc.tenant-b.certificate-chain-inline=true

// after
quarkus.oidc.tenant-b.application-type=service
# remove auth-server-url so cert-chain verification is allowed

if (!"service".equals(oidcConfig.applicationType().orElse("service")) && usesCertChainVerification(oidcConfig)) {
    throw new IllegalStateException("certificate-chain verification requires a 'service' application-type tenant");
}

boolean isServiceAppTenant(OidcTenantConfig cfg) {
    return cfg.authServerUrl().isEmpty() && !cfg.token().isUserinfoRequired().orElse(false);
}

When it happens

Trigger: An OidcTenantConfig sets a certificate-chain based token verification (e.g. quarkus.oidc.token-path or public-key verification via inlined certs / tls certificate-chain) while the tenant also configures an auth-server-url / code flow, making OidcUtils.isServiceApp(oidcConfig) return false when createTenantContextToVerifyCertChain runs.

Common situations: Copying a service-app config into a web-app tenant; mixing token verification via inlined certificates with authorization-code-flow configuration; setting verification strategy to 'certificate' on a tenant with authentication.request or code-flow settings.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu
• Access token is required to check the roles but DefaultToken
• UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/db52a7a4feceec9f. Report an issue: GitHub.