quarkusio/quarkus · error · IllegalStateException

OIDC client feature is disabled with `quarkus.oidc-client.en

Error message

OIDC client feature is disabled with `quarkus.oidc-client.enabled=false` but the getTokens() method is called.

What it means

getTokens() on AbstractTokensProducer throws this IllegalStateException when the OIDC client feature was disabled at build time (quarkus.oidc-client.enabled=false) but the application still attempts to acquire tokens at runtime. Without the feature, no OidcClient exists to produce tokens.

Source

Thrown at extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/AbstractTokensProducer.java:94

                    + " but the initTokens() method is called.");
        }
        if (earlyTokenAcquisition) {
            // Skip early token acquisition for deferred clients - they will recover on first request
            if (oidcClient instanceof DeferredOidcClient) {
                LOG.debug("Skipping early token acquisition for deferred OIDC client");
                return;
            }
            tokensHelper.initTokens(oidcClient, additionalParameters());
        }
    }

    public Uni<Tokens> getTokens() {
        return getTokens(additionalParameters());
    }

    public Uni<Tokens> getTokens(Map<String, String> additionalParameters) {
        if (isClientFeatureDisabled()) {
            throw new IllegalStateException("OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`"
                    + " but the getTokens() method is called.");
        }
        final boolean forceNewTokens = isForceNewTokens();
        if (forceNewTokens) {
            final Optional<String> clientId = clientId();
            LOG.debugf("%s OidcClient will discard the current access and refresh tokens",
                    clientId.orElse(DEFAULT_OIDC_CLIENT_ID));
        }
        return tokensHelper.getTokens(oidcClient, additionalParameters, forceNewTokens);
    }

    public Tokens awaitTokens() {
        if (isClientFeatureDisabled()) {
            throw new IllegalStateException("OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`.");
        }
        return getTokens().await().indefinitely();
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Re-enable the OIDC client feature (remove quarkus.oidc-client.enabled=false).
2. Do not inject/call TokensProducer in applications where the feature is disabled.
3. Gate the calling code on feature availability (e.g. check quarkus.oidc-client.enabled via BuildTimeConfig) before calling getTokens().

Example fix

// before
Tokens t = producer.getTokens().await().indefinitely();

// after
if (!producer.isClientFeatureDisabled()) {
    Tokens t = producer.getTokens().await().indefinitely();
}

if (producer.isClientFeatureDisabled()) {
    throw new IllegalStateException("Cannot get tokens: quarkus.oidc-client.enabled=false");
}

try {
    return producer.getTokens().await().indefinitely();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("oidc-client.enabled=false")) {
        return null; // or fallback auth path
    }
    throw e;
}

When it happens

Trigger: Calling getTokens()/getTokens(Map) on a producer bean in an application built with quarkus.oidc-client.enabled=false.

Common situations: Injecting TokensProducer into code that remains active even though the extension was disabled at build time; runtime profile differences where the flag was disabled but calling code wasn't.

Related errors

• OIDC client feature is disabled with `quarkus.oidc-client.en
• OIDC client feature is disabled with `quarkus.oidc-client.en
• Failed to load application configuration
• Failed to initialize application configuration
• Build time property cannot be changed at runtime: ${mismatch

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/135b919d421d5131. Report an issue: GitHub.