quarkusio/quarkus · error · ConfigurationException

Introspection path is configured and 'verifyAccessTokenWithU

Error message

Introspection path is configured and 'verifyAccessTokenWithUserInfo' is enabled, these options are mutually exclusive

What it means

Verifying the access token via UserInfo and via token introspection are two alternative verification mechanisms; configuring both is contradictory. When discovery is disabled and both introspectionPath and verifyAccessTokenWithUserInfo are set, Quarkus rejects the tenant configuration.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:340

                    || oidcConfig.roles().source()
                            .orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo) {
                throw new ConfigurationException(
                        "UserInfo is required but DefaultTokenStateManager is configured to not keep the access token");
            }
            if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.accesstoken) {
                throw new ConfigurationException(
                        "Access token is required to check the roles but DefaultTokenStateManager is configured to not keep the access token");
            }
        }

        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {
            if (!oidcConfig.discoveryEnabled().orElse(true)) {
                if (oidcConfig.userInfoPath().isEmpty()) {
                    throw new ConfigurationException(
                            "UserInfo path is missing but 'verifyAccessTokenWithUserInfo' is enabled");
                }
                if (oidcConfig.introspectionPath().isPresent()) {
                    throw new ConfigurationException(
                            "Introspection path is configured and 'verifyAccessTokenWithUserInfo' is enabled, these options are mutually exclusive");
                }
            }
        }

        if (!oidcConfig.token().issuedAtRequired() && oidcConfig.token().age().isPresent()) {
            String tokenIssuedAtRequired = getConfigPropertyForTenant(tenantId, "token.issued-at-required");
            String tokenAge = getConfigPropertyForTenant(tenantId, "token.age");
            throw new ConfigurationException(
                    "The '" + tokenIssuedAtRequired + "' can only be set to false if '" + tokenAge + "' is not set." +
                            " Either set '" + tokenIssuedAtRequired + "' to true or do not set '" + tokenAge + "'.",
                    Set.of(tokenIssuedAtRequired, tokenAge));
        }

        return createOidcProvider(oidcConfig).flatMap(p -> TenantConfigContext.createReady(p, oidcConfig));
    }

    private void verifyAllowedRoutes(OidcTenantConfig oidcConfig, String tenantId) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove quarkus.oidc.introspection-path if UserInfo verification is desired
2. Set token.verify-access-token-with-user-info=false to use introspection instead
3. Re-enable discovery and configure verification strategy explicitly via token.allow-opaque-token-introspection/verification preferences

Example fix

// before
quarkus.oidc.discovery-enabled=false
quarkus.oidc.introspection-path=/introspect
quarkus.oidc.token.verify-access-token-with-user-info=true
// after
quarkus.oidc.discovery-enabled=false
quarkus.oidc.token.verify-access-token-with-user-info=true
quarkus.oidc.user-info-path=/userinfo
# introspection-path removed

if (config.token().verifyAccessTokenWithUserInfo().orElse(false) && config.introspectionPath().isPresent()) {
    throw new IllegalArgumentException("choose either UserInfo or introspection, not both");
}

When it happens

Trigger: verifyAccessTokenWithUserInfo() is true, discoveryEnabled() is false, and introspectionPath().isPresent() at createTenantContext.

Common situations: Configuring both quarkus.oidc.introspection-path and quarkus.oidc.user-info-path with verify-access-token-with-user-info=true on a discovery-disabled tenant; switching verification methods without removing the old path property.

Related errors

• Token is opaque but the opaque token introspection is not al
• Either 'jwks-path' or 'introspection-path' properties must b
• The '%s' property can only be set to 'idtoken' for WEB_APP a
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e6a3014409e41f6a. Report an issue: GitHub.