quarkusio/quarkus · error · ConfigurationException

OpenId Connect Provider client registration endpoint URL is

Error message

OpenId Connect Provider client registration endpoint URL is not configured and can not be discovered

What it means

During startup the recorder fetches the provider's OIDC discovery metadata to find the client registration endpoint (clientRegistrationUri). If discovery succeeded (or returned no usable metadata) but the registration URI is still null, it throws a ConfigurationException because registration can neither be discovered nor was it explicitly configured. The client is closed before throwing.

Source

Thrown at extensions/oidc-client-registration/runtime/src/main/java/io/quarkus/oidc/client/registration/runtime/OidcClientRegistrationRecorder.java:164

                                OidcCommonUtils.getOidcEndpointUrl(authServerUriString, oidcConfig.registrationPath())));
            } else {
                clientRegConfigUni = discoverRegistrationUri(client, oidcRequestFilters, oidcResponseFilters,
                        authServerUriString, vertx, oidcConfig);
            }
        }
        return clientRegConfigUni.onItemOrFailure()
                .transformToUni(new BiFunction<OidcConfigurationMetadata, Throwable, Uni<? extends OidcClientRegistration>>() {

                    @Override
                    public Uni<OidcClientRegistration> apply(OidcConfigurationMetadata metadata, Throwable t) {
                        if (t != null) {
                            client.close();
                            throw toOidcClientRegException(getEndpointUrl(oidcConfig), t);
                        }

                        if (metadata.clientRegistrationUri == null) {
                            client.close();
                            throw new ConfigurationException(
                                    "OpenId Connect Provider client registration endpoint URL is not configured and can not be discovered");
                        }

                        final long connectionDelayInMillisecs = OidcCommonUtils.getConnectionDelayInMillis(oidcConfig);

                        ClientMetadata clientMetadata = OidcClientRegistrationImpl.createMetadata(oidcConfig.metadata());
                        if (!oidcConfig.registerEarly()) {
                            LOG.debugf("%s client registration is delayed",
                                    oidcConfig.id().orElse(DEFAULT_ID));
                            return Uni.createFrom().item(new OidcClientRegistrationImpl(client,
                                    connectionDelayInMillisecs,
                                    metadata.clientRegistrationUri,
                                    oidcConfig,
                                    null,
                                    oidcRequestFilters,
                                    oidcResponseFilters));
                        } else if (clientMetadata.getJsonObject().isEmpty()) {
                            LOG.debugf("%s client registration is skipped because its metadata is not configured",

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc-client-registration...registration-path to the provider's explicit registration endpoint URL
2. Verify the auth-server-url points to the correct realm/issuer whose discovery document includes registration_endpoint
3. Confirm the provider supports dynamic client registration (RFC 7591); otherwise register clients out-of-band

Example fix

# before
quarkus.oidc-client-registration.auth-server-url=https://idp.example.com  # no registration_endpoint
# after
quarkus.oidc-client-registration.registration-path=https://idp.example.com/oidc/register

// Verify the provider advertises dynamic registration before enabling it
var doc = Json.decodeValue(DiscoveryClient.discover(authServerUrl + "/.well-known/openid-configuration"));
if (doc.getJsonObject("registration_endpoint") == null) {
    // set registration-path explicitly instead of relying on discovery
}

null

try {
    reg = clientRegistration.await().indefinitely();
} catch (ConfigurationException e) {
    LOG.errorf("Cannot discover registration endpoint: %s — set registration-path explicitly", e.getMessage());
}

When it happens

Trigger: auth-server-url is set and discovery returns a document without registration_endpoint, and no absolute quarkus.oidc-client-registration...registration-path is configured.

Common situations: Identity providers that don't implement RFC 7591 dynamic client registration (no registration_endpoint in their discovery document), an issuer URL pointing to the wrong realm, or an IDP behind a proxy stripping discovery fields.

Related errors

• 'web-app' applications must have '%s' and '%s' properties se
• Either 'jwks-path' or 'introspection-path' properties must b
• UserInfo is required but '%s' is not configured.
• Dynamic tenant ID cannot be same as the default tenant ID: %
• Both public key and certificate chain verification modes are

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/47f46e43cbddab16. Report an issue: GitHub.