quarkusio/quarkus · error · ConfigurationException

Failed to find a matching OidcTenantConfig for tenant:

Error message

Failed to find a matching OidcTenantConfig for tenant: 

What it means

getOidcTenantConfig looks up the tenant configuration for the given tenant id from the TenantConfigBean; when a non-default tenant has no statically configured OidcTenantConfig, a ConfigurationException is thrown. The policy enforcer cannot operate without tenant configuration.

Source

Thrown at extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java:229

        config1.setClaimInformationPointConfig(
                getClaimInformationPointConfig(pathConfig.claimInformationPoint()));
        return config1;
    }

    private static boolean isNotComplexConfigKey(String key) {
        // ignore complexConfig keys for reasons explained in the following comment:
        // https://github.com/quarkusio/quarkus/issues/39315#issuecomment-1991604044
        return !key.contains(".");
    }

    static OidcTenantConfig getOidcTenantConfig(TenantConfigBean tenantConfigBean, String tenant) {
        if (tenant == null || DEFAULT_TENANT_ID.equals(tenant)) {
            return tenantConfigBean.getDefaultTenant().getOidcTenantConfig();
        }

        var staticTenant = tenantConfigBean.getStaticTenant(tenant);
        if (staticTenant == null || staticTenant.oidcConfig() == null) {
            throw new ConfigurationException("Failed to find a matching OidcTenantConfig for tenant: " + tenant);
        }
        return staticTenant.oidcConfig();
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Define configuration for the missing tenant: quarkus.oidc."<tenant>".auth-server-url=... (and client-id/credentials) so getStaticTenant finds it.
2. Verify the tenant id being passed matches the quoted config key exactly (case-sensitive) and the resolved tenant from the request.
3. If tenants are dynamic, ensure a dynamic tenants config provider is set up so lookup doesn't rely on static tenants only.
4. Use the default tenant (remove the tenant attribute/parameter) if per-tenant config isn't actually needed.

Example fix

// before (tenant 'acme' referenced but not configured)
quarkus.oidc.auth-server-url=https://sso/realms/main
// after
quarkus.oidc."acme".auth-server-url=https://sso/realms/acme
quarkus.oidc."acme".client-id=pep-client

// check tenant config exists before requesting a per-tenant policy enforcer
String tenant = resolvedTenantId;
if (!DEFAULT_TENANT.equals(tenant) && staticTenantIds.stream().noneMatch(tenant::equals)) {
    throw new IllegalStateException("No quarkus.oidc.\"" + tenant + "\" config; define it or use the default tenant");
}

try {
    OidcTenantConfig cfg = KeycloakPolicyEnforcerUtil.getOidcTenantConfig(tenantConfigBean, tenant);
} catch (ConfigurationException e) {
    log.error("Tenant '{}' not configured: add quarkus.oidc.\"{}\".auth-server-url", tenant, tenant, e);
    throw e;
}

When it happens

Trigger: Requesting/creating a policy enforcer for a tenant id that has no matching quarkus.oidc.<tenant>. configuration (static tenants only) — e.g. tenant resolved from the token issuer or a tenant-path/tenant-id connection parameter that doesn't match any configured tenant, and no dynamic tenant config is registered.

Common situations: Renamed or removed tenant config keys (quarkus.oidc."my-tenant".auth-server-url) while code still references the old tenant id; issuer-based tenant resolution matching no static tenant; typos in tenant identifiers; relying on tenants only created dynamically at runtime without a dynamic resolver.

Related errors

• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to create Keycloak Admin client SSLContext
• Failed to load truststore
• Failed to load keystore

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ae2b5b93d0d5a124. Report an issue: GitHub.