quarkusio/quarkus · error · ConfigurationException

Either 'quarkus.oidc-client-registration<clientName>.auth-se

Error message

Either 'quarkus.oidc-client-registration<clientName>.auth-server-url' or absolute 'quarkus.oidc-client-registration<clientName>.registration-path' URL must be set

What it means

At recording/initialization time the OidcClientRegistrationRecorder validates configuration. For a named client registration, either an OIDC auth-server-url (from which the registration endpoint can be discovered) or an absolute registration-path URL must be configured. If both are missing while metadata is present, a ConfigurationException is thrown naming the exact properties to fix (the clientName suffix is appended for named configs).

Source

Thrown at extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/runtime/OidcClientRegistrationRecorder.java:118

                .atMost(oidcConfig.connectionTimeout());
    }

    public static Uni<OidcClientRegistration> createOidcClientRegistrationUni(OidcClientRegistrationConfig oidcConfig,
            OidcTlsSupport tlsSupport, Supplier<Vertx> vertxSupplier,
            Supplier<ProxyConfigurationRegistry> proxyConfigurationRegistrySupplier) {
        if (!oidcConfig.registrationEnabled()) {
            String message = String.format("'%s' client registration configuration is disabled", "");
            LOG.debug(message);
            return Uni.createFrom().item(new DisabledOidcClientRegistration(message));
        }

        try {
            if (oidcConfig.authServerUrl().isEmpty() && !OidcCommonUtils.isAbsoluteUrl(oidcConfig.registrationPath())) {
                if (isEmptyMetadata(oidcConfig.metadata())) {
                    return Uni.createFrom().nullItem();
                }
                var clientName = DEFAULT_ID.equals(oidcConfig.id().orElse(DEFAULT_ID)) ? "" : "." + oidcConfig.id().get();
                throw new ConfigurationException(
                        "Either 'quarkus.oidc-client-registration" + clientName
                                + ".auth-server-url' or absolute 'quarkus.oidc-client-registration" + clientName
                                + ".registration-path' URL must be set");
            }
            OidcCommonUtils.verifyEndpointUrl(getEndpointUrl(oidcConfig));
        } catch (Throwable t) {
            LOG.error(t.getMessage());
            String message = String.format("'%s' client registration configuration is not initialized",
                    oidcConfig.id().orElse("Default"));
            return Uni.createFrom().failure(new RuntimeException(message));
        }

        final io.vertx.mutiny.core.Vertx vertx = new io.vertx.mutiny.core.Vertx(vertxSupplier.get());
        OidcWebClient client = OidcWebClient.create(oidcConfig, tlsSupport, vertx, proxyConfigurationRegistrySupplier.get(),
                "OIDC client registration `" + oidcConfig.id().orElse(DEFAULT_ID) + "`");

        Map<OidcEndpoint.Type, List<OidcRequestFilter>> oidcRequestFilters = OidcCommonUtils.getOidcRequestFilters();
        Map<OidcEndpoint.Type, List<OidcResponseFilter>> oidcResponseFilters = OidcCommonUtils.getOidcResponseFilters();

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc-client-registration.auth-server-url (or the <clientName> variant) to the OIDC provider base URL
2. Or set registration-path to an absolute URL, e.g. https://provider/registration-endpoint
3. If registration is intentionally unused, remove the metadata properties so a null Uni is returned instead

Example fix

# before
quarkus.oidc-client-registration.myclient.registration-path=/clients
# after
quarkus.oidc-client-registration.myclient.auth-server-url=https://idp.example.com/realms/main

String authServerUrl = config.getValue("quarkus.oidc-client-registration.auth-server-url");
String regPath = config.getValue("quarkus.oidc-client-registration.registration-path");
if ((authServerUrl == null || authServerUrl.isBlank()) && (regPath == null || !regPath.startsWith("http"))) {
    throw new IllegalStateException("Configure auth-server-url or an absolute registration-path");
}

static boolean registrationConfigured(String authServerUrl, String registrationPath) {
    return authServerUrl != null && !authServerUrl.isBlank()
        || registrationPath != null && registrationPath.startsWith("https://");
}

try {
    OidcClientRegistration reg = registrationUni.await().indefinitely();
} catch (ConfigurationException e) {
    LOG.errorf("Registration config error: %s", e.getMessage()); // fix properties
}

When it happens

Trigger: Setting quarkus.oidc-client-registration.<clientName>.metadata (or other props) but leaving both quarkus.oidc-client-registration<clientName>.auth-server-url unset and registration-path as a non-absolute URL.

Common situations: Typo in property prefix (missing client-name segment), providing only a relative registration-path like '/clients-registrations' instead of a full https:// URL, migrating from the default (unnamed) config to a named one without adding auth-server-url.

Related errors

• Dynamic tenant ID cannot be same as the default tenant ID: %
• Both public key and certificate chain verification modes are
• '%s' property must be configured
• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required but '%s' is enabled

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/413bc3f9deca6365. Report an issue: GitHub.