quarkusio/quarkus · error · IllegalStateException

OIDC client feature is disabled with `quarkus.oidc-client.en

Error message

OIDC client feature is disabled with `quarkus.oidc-client.enabled=false` but the initTokens() method is called.

What it means

AbstractTokensProducer.initTokens() checks the build-time flag quarkus.oidc-client.enabled. When the OIDC client feature has been disabled at build time but a producer still calls initTokens(), an IllegalStateException is thrown because token acquisition cannot work in a disabled feature.

Source

Thrown at extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/AbstractTokensProducer.java:75

        initTokens();
        if (!isForceNewTokens()) {
            oidcClients.registerTokenRefresh(oidcClient, new Supplier<Uni<Tokens>>() {
                @Override
                public Uni<Tokens> get() {
                    return getTokens();
                }
            });
        }
    }

    protected boolean isClientFeatureDisabled() {
        return !oidcClientBuildTimeConfig.enabled();
    }

    protected void initTokens() {
        if (isClientFeatureDisabled()) {
            throw new IllegalStateException("OIDC client feature is disabled with `quarkus.oidc-client.enabled=false`"
                    + " but the initTokens() method is called.");
        }
        if (earlyTokenAcquisition) {
            // Skip early token acquisition for deferred clients - they will recover on first request
            if (oidcClient instanceof DeferredOidcClient) {
                LOG.debug("Skipping early token acquisition for deferred OIDC client");
                return;
            }
            tokensHelper.initTokens(oidcClient, additionalParameters());
        }
    }

    public Uni<Tokens> getTokens() {
        return getTokens(additionalParameters());
    }

    public Uni<Tokens> getTokens(Map<String, String> additionalParameters) {
        if (isClientFeatureDisabled()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the initTokens() call (or the producer bean) from code paths active when the feature is disabled.
2. Guard the call: only call initTokens() when isClientFeatureDisabled() is false.
3. If tokens are actually needed, re-enable the feature by removing quarkus.oidc-client.enabled=false (or set it to true).

Example fix

// before
@PostConstruct
void init() { initTokens(); }

// after
@PostConstruct
void init() {
    if (!isClientFeatureDisabled()) {
        initTokens();
    }
}

if (producer.isClientFeatureDisabled()) {
    return; // skip token init
}

try {
    initTokens();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("oidc-client.enabled=false")) {
        LOG.warn("OIDC client disabled; skipping token initialization");
    } else throw e;
}

When it happens

Trigger: An application includes a class extending AbstractTokensProducer (e.g. a custom TokensProducer or OidcClients producer) and its init() invokes initTokens() while quarkus.oidc-client.enabled=false at build time.

Common situations: Disabling the OIDC client extension to trim the build but leaving a @PostConstruct that calls initTokens(); shared library code that unconditionally initializes tokens.

Related errors

• OIDC client feature is disabled with `quarkus.oidc-client.en
• OIDC client feature is disabled with `quarkus.oidc-client.en
• Failed to load application configuration
• Failed to initialize application configuration
• Can only sync state on the server side of remote dev mode

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/074c498a1acbe2c7. Report an issue: GitHub.