quarkusio/quarkus · error · IllegalStateException

OIDC client feature is disabled with `quarkus.oidc-client.en

Error message

OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`.

What it means

awaitTokens() blocks and returns Tokens synchronously, but first checks the same build-time flag. With quarkus.oidc-client.enabled=false it throws IllegalStateException because token acquisition is impossible in the disabled feature.

Source

Thrown at extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/AbstractTokensProducer.java:108

    }

    public Uni<Tokens> getTokens(Map<String, String> additionalParameters) {
        if (isClientFeatureDisabled()) {
            throw new IllegalStateException("OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`"
                    + " but the getTokens() method is called.");
        }
        final boolean forceNewTokens = isForceNewTokens();
        if (forceNewTokens) {
            final Optional<String> clientId = clientId();
            LOG.debugf("%s OidcClient will discard the current access and refresh tokens",
                    clientId.orElse(DEFAULT_OIDC_CLIENT_ID));
        }
        return tokensHelper.getTokens(oidcClient, additionalParameters, forceNewTokens);
    }

    public Tokens awaitTokens() {
        if (isClientFeatureDisabled()) {
            throw new IllegalStateException("OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`.");
        }
        return getTokens().await().indefinitely();
    }

    /**
     * @return optional ID of OIDC client to use for token acquisition.
     *         Defaults to default OIDC client when {@link Optional#empty() empty}.
     */
    protected Optional<String> clientId() {
        return Optional.empty();
    }

    /**
     * @return Initialized OidcClient.
     */
    protected Optional<OidcClient> client() {
        return Optional.empty();
    }

View on GitHub (pinned to e1c734241f)

Solutions

1. Re-enable the feature by removing or setting quarkus.oidc-client.enabled=true.
2. Remove the awaitTokens() call path when the feature is disabled.
3. Conditionally invoke awaitTokens() only when isClientFeatureDisabled() is false.

Example fix

// before
Tokens t = producer.awaitTokens();

// after
if (!producer.isClientFeatureDisabled()) {
    Tokens t = producer.awaitTokens();
}

if (producer.isClientFeatureDisabled()) {
    throw new IllegalStateException("Cannot await tokens: quarkus.oidc-client.enabled=false");
}

try {
    Tokens t = producer.awaitTokens();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("oidc-client.enabled=false")) {
        throw new ServiceUnavailableException("OIDC client feature disabled");
    }
    throw e;
}

When it happens

Trigger: Calling awaitTokens() on an AbstractTokensProducer subclass in an application built with quarkus.oidc-client.enabled=false.

Common situations: Synchronous (non-reactive) code paths calling awaitTokens() in services where the OIDC client extension was disabled at build time to reduce footprint.

Related errors

• OIDC client feature is disabled with `quarkus.oidc-client.en
• OIDC client feature is disabled with `quarkus.oidc-client.en
• Failed to load application configuration
• Failed to initialize application configuration
• Build time property cannot be changed at runtime: ${mismatch

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/767a33dd18059208. Report an issue: GitHub.