quarkusio/quarkus · error · java.lang.IllegalStateException

Resource metadata path cannot contain a wildcard '*' charact

Error message

Resource metadata path cannot contain a wildcard '*' character

What it means

The OIDC resource metadata (RFC 9728) path handler in ResourceMetadataHandler.createOrUpdatePathMatcher throws IllegalStateException when a tenant's resource metadata path contains a wildcard '*'. Wildcard routes are unsupported for serving the /.well-known resource metadata documents.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/ResourceMetadataHandler.java:76

    }

    synchronized void updatePathMatcher(@Observes NewResourceMetadata ignored) {
        createOrUpdatePathMatcher();
    }

    private void createOrUpdatePathMatcher() {
        ImmutablePathMatcher.ImmutablePathMatcherBuilder<Handler<RoutingContext>> builder = null;
        Map<String, OidcTenantConfig> pathCache = null;
        for (TenantConfigContext configContext : resolver.getTenantConfigBean().getAllTenantConfigs()) {
            if (configContext.ready() && configContext.oidcConfig().tenantEnabled()
                    && configContext.oidcConfig().resourceMetadata().enabled()) {
                if (builder == null) {
                    builder = ImmutablePathMatcher.builder();
                    pathCache = new HashMap<>();
                }
                String routePath = getResourceMetadataPath(configContext.oidcConfig(), resolver.getRootPath());
                if (routePath.contains("*")) {
                    throw new IllegalStateException("Resource metadata path cannot contain a wildcard '*' character");
                }
                OidcTenantConfig previousConfig = pathCache.put(routePath, configContext.oidcConfig());
                if (previousConfig == null) {
                    Handler<RoutingContext> routeHandler = new RouteHandler(configContext.oidcConfig(), resolver);
                    builder.addPath(routePath, routeHandler);
                } else {
                    String previousTenantId = previousConfig.tenantId().get();
                    String currentTenantId = configContext.oidcConfig().tenantId().get();
                    // maybe invalid state, but technically it could happen that some produces a static tenant with
                    // a same id as a dynamic tenant
                    if (!previousTenantId.equals(currentTenantId)) {
                        String errorMessage = "OIDC tenants '%s' and '%s' share the same resource metadata path '%s', which is not supported"
                                .formatted(previousTenantId, currentTenantId, routePath);
                        LOG.error(errorMessage);
                        throw new OIDCException(errorMessage);
                    }
                }
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the '*' character from the tenant's resource metadata / base path configuration
2. Configure explicit, literal paths for resource metadata endpoints
3. Validate dynamically supplied tenant root paths before passing them to OidcTenantConfig

Example fix

// before
quarkus.oidc.tenant-a.resource-metadata.base-path=/api/*
// after
quarkus.oidc.tenant-a.resource-metadata.base-path=/api/tenant-a

String path = config.resourceMetadataBasePath();
if (path != null && path.contains("*")) throw new IllegalArgumentException("resource metadata path cannot contain '*'");

try { startApplication(); } catch (IllegalStateException e) { fail("Fix tenant resource-metadata path: " + e.getMessage()); }

When it happens

Trigger: Configuring quarkus.oidc.<tenant>.resource-metadata (or a TenantResolver-provided config) whose computed path (getResourceMetadataPath, based on the tenant's base path or root path) contains '*', then building the path matcher during setup or updatePathMatcher.

Common situations: Misconfigured tenant root/base path containing wildcard patterns; copying a route-pattern style path into OIDC resource metadata configuration; dynamic tenant configs built from user input containing '*'.

Related errors

• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to find a matching OidcTenantConfig for tenant:
• Truststore with configured password which keeps thumbprints
• Token is opaque but the opaque token introspection is not al

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/af3786baa346b147. Report an issue: GitHub.