quarkusio/quarkus · error · ConfigurationException

OpenId Connect Provider token endpoint URL is not configured

Error message

OpenId Connect Provider token endpoint URL is not configured and can not be discovered

What it means

During OIDC client initialization (OidcClientImpl.of), the metadata resolution must yield a token endpoint URL. This ConfigurationException is thrown when the OIDC discovery metadata is null or contains no token_request_uri, meaning the provider's token endpoint could be neither configured directly nor discovered.

Source

Thrown at extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java:521

            Function<ClientCredentials, Uni<OidcConfigurationMetadata>> metadataResolver, String grantType,
            MultiMap tokenGrantParams, MultiMap commonRefreshGrantParams, OidcClientConfig oidcClientConfig,
            Map<OidcEndpoint.Type, List<OidcRequestFilter>> requestFilters,
            Map<OidcEndpoint.Type, List<OidcResponseFilter>> responseFilters, Vertx vertx) {
        final boolean jwtAssertionProvided = oidcClientConfig.credentials().jwt().source() != Source.CLIENT;
        final ClientAssertionProvider assertionProvider = getClientAssertionProvider(vertx, oidcClientConfig.credentials(),
                oidcClientConfig.authServerUrl());
        return OidcCommonUtils.clientSecret(oidcClientConfig.credentials())
                .onItem().ifNotNull()
                .transform(clientSecret -> new ClientCredentials(null, clientSecret,
                        OidcCommonUtils.initClientSecretBasicAuth(oidcClientConfig, clientSecret),
                        jwtAssertionProvided, assertionProvider))
                .onItem().ifNull()
                .switchTo(() -> OidcCommonUtils.initClientJwtKey(oidcClientConfig)
                        .map(key -> new ClientCredentials(key, null, null, jwtAssertionProvided, assertionProvider)))
                .<OidcClient> flatMap(clientCredentials -> metadataResolver.apply(clientCredentials)
                        .map(metadata -> {
                            if (metadata == null || metadata.tokenRequestUri == null) {
                                throw new ConfigurationException(
                                        "OpenId Connect Provider token endpoint URL is not configured and can not be discovered");
                            }
                            return new OidcClientImpl(client, metadata.tokenRequestUri, metadata.tokenRevokeUri, grantType,
                                    tokenGrantParams,
                                    commonRefreshGrantParams, oidcClientConfig, requestFilters, responseFilters, vertx,
                                    clientCredentials);
                        }))
                .onFailure().invoke(t -> {
                    LOG.error("Failed to create OidcClientImpl", t);
                    if (t instanceof ConfigurationException) {
                        client.close();
                    }
                });
    }

    record ClientCredentials(Key clientJwtKey, String clientSecret, String clientSecretBasicAuthScheme,
            boolean jwtAssertionProvided, ClientAssertionProvider clientAssertionProvider) {
    }

View on GitHub (pinned to e1c734241f)

Solutions

Set an absolute quarkus.oidc-client.token-path explicitly
Verify auth-server-url points to a reachable provider with discovery metadata containing token_endpoint
If discovery is disabled, ensure token-path is set
Check network/proxy availability of the provider's .well-known endpoint

Example fix

# before
quarkus.oidc-client.auth-server-url=http://localhost:8180/realms/test
# provider without discovery

# after
quarkus.oidc-client.auth-server-url=http://localhost:8180/realms/test
quarkus.oidc-client.token-path=http://localhost:8180/realms/test/protocol/openid-connect/token

Defensive patterns

Strategy: validation

Validate before calling

if ((config.authServerUrl().isEmpty() || !isDiscoveryReachable(config.authServerUrl().get())) && !isAbsolute(config.tokenPath())) {
    throw new IllegalArgumentException("Provide token-path or ensure discovery metadata contains token_endpoint");
}

Type guard

boolean hasTokenEndpoint(OidcClientConfig c) {
    return OidcCommonUtils.isAbsoluteUrl(c.tokenPath()) || c.authServerUrl().isPresent();
}

Try / catch

try { client = oidcClients.newClient(config).await().indefinitely(); } catch (ConfigurationException e) { if (e.getMessage().contains("token endpoint URL is not configured")) { config = withExplicitTokenPath(config); client = oidcClients.newClient(config).await().indefinitely(); } else throw e; }

Prevention

Verify the provider publishes .well-known/openid-configuration with token_endpoint
Set token-path explicitly when discovery is unavailable
Test metadata fetch from the deployment network (proxy/firewall)

When it happens

Trigger: Creating an OidcClient via OidcClientImpl.of / OidcClients.newClient where neither discovery metadata provides a token endpoint nor is the token path configured; discovery enabled but provider's .well-known/openid-configuration lacks token_endpoint; discovery URL unreachable returning empty metadata.

Common situations: Pointing auth-server-url at a provider that does not publish discovery metadata; misconfigured discovery URL returning 404; disabling discovery but forgetting to set token-path; network/proxy blocking metadata fetch.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e3db3323c29c79eb. Report an issue: GitHub.