quarkusio/quarkus · error · ConfigurationException

'%s' is invalid

Error message

'%s' is invalid

What it means

OidcCommonUtils.verifyEndpointUrl validates that a configured OIDC endpoint URL (issuer, token, or discovery URL) parses as a valid absolute URL via URI.create(...).toURL(). If parsing fails for any reason, the original endpoint URL is wrapped in a SmallRye ConfigurationException with the message "'<url>' is invalid".

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:161

        JsonObject maskedJson = jsonObject.copy();
        if (maskedJson.containsKey(OidcConstants.ACCESS_TOKEN_VALUE)) {
            maskedJson.put(OidcConstants.ACCESS_TOKEN_VALUE, "...");
        }
        if (maskedJson.containsKey(OidcConstants.REFRESH_TOKEN_VALUE)) {
            maskedJson.put(OidcConstants.REFRESH_TOKEN_VALUE, "...");
        }
        if (maskedJson.containsKey(OidcConstants.ID_TOKEN_VALUE)) {
            maskedJson.put(OidcConstants.ID_TOKEN_VALUE, "...");
        }
        return maskedJson;
    }

    public static void verifyEndpointUrl(String endpointUrl) {
        try {
            // Verify that endpoint url is a valid URL
            URI.create(endpointUrl).toURL();
        } catch (Throwable ex) {
            throw new ConfigurationException(
                    String.format("'%s' is invalid", endpointUrl), ex);
        }
    }

    public static void verifyCommonConfiguration(OidcClientCommonConfig oidcConfig, boolean clientIdOptional,
            boolean isServerConfig) {
        final String configPrefix = isServerConfig ? "quarkus.oidc." : "quarkus.oidc-client.";
        if (!clientIdOptional && !oidcConfig.clientId().isPresent()) {
            throw new ConfigurationException(
                    String.format("'%sclient-id' property must be configured", configPrefix));
        }

        Credentials creds = oidcConfig.credentials();
        if (creds.secret().isPresent() && creds.clientSecret().value().isPresent()) {
            throw new ConfigurationException(
                    String.format(
                            "'%1$scredentials.secret' and '%1$scredentials.client-secret' properties are mutually exclusive",
                            configPrefix));

View on GitHub (pinned to e1c734241f)

Solutions

1. Fix the URL in application.properties/env so it is a well-formed absolute http(s) URL
2. Verify that config property substitution (env vars, profiles) resolves correctly at runtime
3. URL-encode any special characters (spaces, non-ASCII) in the endpoint URL

Example fix

// before
quarkus.oidc.auth-server-url=htps://idp.example.com/realms/main
// after
quarkus.oidc.auth-server-url=https://idp.example.com/realms/main

try {
    new java.net.URI(url).toURL();
} catch (Exception e) {
    throw new IllegalArgumentException("Invalid OIDC endpoint URL: " + url, e);
}

boolean isValidUrl(String s) {
    if (s == null || s.isBlank()) return false;
    try { new java.net.URI(s).toURL(); return true; } catch (Exception e) { return false; }
}

try {
    oidcConfig.validate();
} catch (ConfigurationException e) {
    LOG.error("OIDC endpoint URL invalid: " + e.getMessage());
}

When it happens

Trigger: At startup/configuration time when any quarkus.oidc.* or quarkus.oidc-client.* URL property (auth-server-url, token-path, discovery url, etc.) contains a malformed value such as missing scheme, illegal characters, or empty string.

Common situations: Typos in config (htps:// instead of https://), unencoded spaces or special characters in URLs, environment-variable placeholders left unresolved, trailing garbage after the host.

Related errors

• Malformed URL: + url
• Unable to find top command. Ensure you have a @CommandDefini
• Persistence unit '<persistenceUnitName>' was configured to r
• Failed to create Keycloak Admin client SSLContext
• Failed to parse the realm name.

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/734998ae060f4b12. Report an issue: GitHub.