quarkusio/quarkus · error · OidcEndpointAccessException

OIDC discovery endpoint request failed

Error message

OIDC discovery endpoint request failed

What it means

OIDC discovery (fetching the .well-known/openid-configuration metadata document) failed — the endpoint returned an error status or was unreachable, with retries/backoff exhausted. The underlying status is surfaced via OidcEndpointAccessException after a warning is logged with the discovery URL and status code.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:706

                .flatMap(resp -> filterHttpResponse(requestProps, resp, responseFilters, Type.DISCOVERY)
                        .map(buffer -> {
                            if (resp.statusCode() == 200) {
                                JsonObject discoveredJson = buffer.toJsonObject();
                                LOG.debugf("Discovered OIDC metadata: %s", discoveredJson);
                                return discoveredJson;
                            } else if (resp.statusCode() == 302) {
                                throw createOidcClientRedirectException(resp);
                            } else {
                                String errorMessage = buffer != null ? buffer.toString() : null;
                                if (errorMessage != null && !errorMessage.isEmpty()) {
                                    LOG.warnf("Discovery request %s has failed, status code: %d, error message: %s",
                                            discoveryUrl,
                                            resp.statusCode(), errorMessage);
                                } else {
                                    LOG.warnf("Discovery request %s has failed, status code: %d", discoveryUrl,
                                            resp.statusCode());
                                }
                                throw new OidcEndpointAccessException(resp.statusCode());
                            }
                        }))
                .onFailure(oidcEndpointNotAvailable())
                .retry()
                .withBackOff(CONNECTION_BACKOFF_DURATION, CONNECTION_BACKOFF_DURATION)
                .expireIn(connectionDelayInMillisecs);
    }

    public static OidcClientRedirectException createOidcClientRedirectException(HttpResponse<Buffer> resp) {
        LOG.debug("OIDC client redirect is requested");
        return new OidcClientRedirectException(resp.getHeader(LOCATION_RESPONSE_HEADER), resp.cookies());
    }

    private static OidcRequestContextProperties getDiscoveryRequestProps(
            OidcRequestContextProperties contextProperties, String discoveryUrl) {
        Map<String, Object> newProperties = contextProperties == null ? new HashMap<>()
                : new HashMap<>(contextProperties.getAll());
        newProperties.put(OidcRequestContextProperties.DISCOVERY_ENDPOINT, discoveryUrl);

View on GitHub (pinned to e1c734241f)

Solutions

1. Verify the auth-server-url is correct and complete (for Keycloak include /realms/<realm>); test the discovery URL in a browser/curl
2. Check the OIDC provider is running and reachable from the app (network, DNS, firewall, k8s service)
3. Inspect the logged warning 'Discovery request ... has failed, status code' for the HTTP status and address TLS/proxy issues accordingly (import the IdP certificate if SSL errors)
4. Increase quarkus.oidc.connection-delay (or connection-retry attempts) if the provider starts slowly
5. If the provider does not support discovery, disable it and configure endpoints manually (e.g. token-path, jwks-path, discovery-enabled=false)

Example fix

// before
quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/wrong-realm
// after
quarkus.oidc.auth-server-url=http://localhost:8180/realms/quarkus
quarkus.oidc.connection-delay=10S

// verify discovery endpoint before startup
HttpResponse<String> resp = HttpClient.newHttpClient().send(
    HttpRequest.newBuilder(URI.create(authServerUrl + "/.well-known/openid-configuration")).GET().build(),
    HttpResponse.BodyHandlers.ofString());
if (resp.statusCode() != 200) throw new IllegalStateException("Discovery endpoint returned " + resp.statusCode());

try { startApp(); } catch (OidcEndpointAccessException e) {
    log.errorf("OIDC discovery failed with status %d; check auth-server-url and provider availability", e.statusCode());
    // retry or fail fast
}

When it happens

Trigger: doDiscoverMetadata sends a GET to <auth-server-url>/.well-known/openid-configuration; the OIDC provider returns 4xx/5xx, or the connection fails and the retry policy (CONNECTION_BACKOFF_DURATION, expireIn connectionDelay) expires.

Common situations: Auth server URL wrong or realm missing (Keycloak needs /realms/<realm>); OIDC server down or restarting; TLS certificate not trusted; discovery disabled endpoint; container networking/DNS issues; connection-delay timeout too short for a slow provider.

Related errors

• Error status:%s
• 'web-app' applications must have '%s' and '%s' properties se
• Either 'jwks-path' or 'introspection-path' properties must b
• UserInfo is required but '%s' is not configured.
• UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bddf1df40d3207f1. Report an issue: GitHub.