quarkusio/quarkus · error · io.quarkus.oidc.runtime.OIDCException

Error status:%s

Error message

Error status:%s

What it means

Generic failure thrown by OidcProviderClientImpl when an HTTP response from the OIDC provider has an error status but the response body contains no parseable error/error_description fields. The message carries only the HTTP status code (e.g. 'Error status:400'), with the full context logged beforehand as 'Request <uri> has failed: status: <code>'.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcProviderClientImpl.java:619

                        }
                        return Uni.createFrom().item(buffer.toString());
                    } else if (resp.statusCode() == 302) {
                        return Uni.createFrom().failure(OidcCommonUtils.createOidcClientRedirectException(resp));
                    } else {
                        return Uni.createFrom().failure(responseException(requestUri, resp, buffer));
                    }
                });
    }

    private static OIDCException responseException(String requestUri, HttpResponse<Buffer> resp, Buffer buffer) {
        String errorMessage = buffer == null ? null : buffer.toString();

        if (errorMessage != null && !errorMessage.isEmpty()) {
            LOG.errorf("Request %s has failed: status: %d, error message: %s", requestUri, resp.statusCode(), errorMessage);
            throw new OIDCException(errorMessage);
        } else {
            LOG.errorf("Request %s has failed: status: %d", requestUri, resp.statusCode());
            throw new OIDCException("Error status:" + resp.statusCode());
        }
    }

    @Override
    public void close() {
        client.close();
        if (clientAssertionProvider != null) {
            clientAssertionProvider.close();
        }
    }

    Key getClientJwtKey() {
        return clientJwtKey;
    }

    String getClientSecret() {
        return clientSecret;
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Read the accompanying log line 'Request <uri> has failed: status: <code>' to identify the failing endpoint and status
2. Hit the same endpoint manually (curl) with identical parameters to inspect the raw response body
3. If a proxy/WAF returns HTML errors, fix or bypass it; correct the endpoint URL in quarkus.oidc.* config
4. For 400s, review the grant parameters (code, redirect_uri, client credentials) for mismatches with what was sent in the authorize request

// pre-flight: check the OIDC discovery endpoint returns JSON before business calls
Response d = httpClient.get(authServerUrl + "/.well-known/openid-configuration");
if (d.statusCode() != 200 || !d.header("Content-Type").contains("json")) {
    throw new IllegalStateException("OIDC endpoint returning non-JSON (status " + d.statusCode() + ")");
}

try {
    tokens = oidcClient.getTokens(code);
} catch (OIDCException e) {
    if (e.getMessage().startsWith("Error status:")) {
        int status = Integer.parseInt(e.getMessage().substring("Error status:".length()).trim());
        if (status >= 500) {
            return retryWithBackoff(...); // transient provider outage
        }
    }
    throw e;
}

When it happens

Trigger: Any OIDC endpoint call (token endpoint, revocation, userinfo, PAR) returning 4xx/5xx whose body cannot be parsed into an OAuth2 error JSON — the provider falls through to this catch-all OIDCException.

Common situations: Authorization server returning HTML error pages (proxies, WAFs, load balancers); token endpoint rejecting a request with a non-OAuth error body; TLS or reverse-proxy misconfigurations; server outages returning text/plain 502/503.

Related errors

• OpenId Connect Provider token endpoint URL is not configured
• OIDC discovery endpoint request failed
• Failed to parse CIDR address "${value}"
• Unable to resolve "${value}"
• Unable to list extension categories

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8cd5ff5e5fc0faa5. Report an issue: GitHub.