quarkusio/quarkus · error · ConfigurationException

Failed to parse the realm name.

Error message

Failed to parse the realm name.

What it means

createPolicyEnforcer derives the realm and auth-server base URL by string manipulation of quarkus.oidc.auth-server-url (splitting on the last '/realms' segment). If the URL does not contain '/realms' as expected, substring arithmetic fails or produces an invalid URL and a ConfigurationException wrapped around the cause is thrown.

Source

Thrown at extensions/keycloak-authorization/runtime/src/main/java/io/quarkus/keycloak/pep/runtime/KeycloakPolicyEnforcerUtil.java:51

    static PolicyEnforcer createPolicyEnforcer(OidcTenantConfig oidcConfig,
            KeycloakPolicyEnforcerTenantConfig keycloakPolicyEnforcerConfig,
            TlsConfigSupport tlsConfigSupport,
            ProxyConfigurationRegistry proxyConfigurationRegistry) {

        if (oidcConfig.applicationType()
                .orElse(OidcTenantConfig.ApplicationType.SERVICE) == OidcTenantConfig.ApplicationType.WEB_APP
                && oidcConfig.roles().source().orElse(null) != OidcTenantConfig.Roles.Source.accesstoken) {
            throw new OIDCException("Application 'web-app' type is only supported if access token is the source of roles");
        }

        AdapterConfig adapterConfig = new AdapterConfig();
        String authServerUrl = oidcConfig.authServerUrl().get();

        try {
            adapterConfig.setRealm(authServerUrl.substring(authServerUrl.lastIndexOf('/') + 1));
            adapterConfig.setAuthServerUrl(authServerUrl.substring(0, authServerUrl.lastIndexOf("/realms")));
        } catch (Exception cause) {
            throw new ConfigurationException("Failed to parse the realm name.", cause);
        }

        adapterConfig.setResource(oidcConfig.clientId().get());
        adapterConfig.setCredentials(getCredentials(oidcConfig));

        if (!tlsConfigSupport.useTlsRegistry()) {
            if (tlsConfigSupport.isGlobalTrustAll()) {
                adapterConfig.setDisableTrustManager(true);
                adapterConfig.setAllowAnyHostname(true);
            }
        }
        adapterConfig.setConnectionPoolSize(keycloakPolicyEnforcerConfig.connectionPoolSize());

        if (oidcConfig.proxy().proxyConfigurationName().isPresent()) {
            ProxyConfiguration proxyConfig = proxyConfigurationRegistry
                    .get(oidcConfig.proxy().proxyConfigurationName())
                    .orElseThrow(() -> new ConfigurationException(
                            "Cannot find the Proxy registry configuration '%s'"

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc.auth-server-url to the canonical form https://<host>/realms/<realm> and verify the resolved value (log or check startup config).
2. Check for typos (e.g. /realm/ vs /realms/) and stray spaces/trailing slashes in the property or env variable.
3. Ensure any property placeholder/env substitution produces a valid URL at runtime (e.g. print env in the container).

Example fix

// before
quarkus.oidc.auth-server-url=https://sso.example.com/auth
// after
quarkus.oidc.auth-server-url=https://sso.example.com/realms/quarkus

String url = config.getOptionalValue("quarkus.oidc.auth-server-url", String.class).orElse("");
if (!url.matches("https?://[^/]+/realms/[^"]+")) {
    throw new IllegalStateException("auth-server-url must be https://host/realms/<realm>: " + url);
}

try {
    PolicyEnforcer pe = KeycloakPolicyEnforcerUtil.createPolicyEnforcer(...);
} catch (ConfigurationException e) {
    if (e.getMessage().contains("Failed to parse the realm name")) {
        log.error("auth-server-url must end with /realms/<realm>: {}", oidcConfig.authServerUrl(), e.getCause());
    }
    throw e;
}

When it happens

Trigger: quarkus.oidc.auth-server-url does not follow the https://host/realms/<realm> shape — e.g. missing /realms segment, trailing garbage, or set via env var/property placeholder resolving to an unexpected value — while the policy enforcer builds the AdapterConfig.

Common situations: Typo like /realm/quarkus (singular) or /realms missing entirely; pointing at an intermediate proxy path that drops /realms; empty or malformed auth-server-url after environment substitution.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• Application 'web-app' type is only supported if access token
• Failed to find a matching OidcTenantConfig for tenant:
• Malformed URL: + url
• Failed to create Keycloak Admin client SSLContext
• Failed to load truststore

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/84fe93a4a312cf70. Report an issue: GitHub.