quarkusio/quarkus · error · io.quarkus.runtime.configuration.ConfigurationException

'%s' property must be configured

Error message

'%s' property must be configured

What it means

Every enabled OIDC tenant that does not use a TenantConfigResolver must know the OIDC provider's auth-server-url. When createTenantContext builds a tenant with no auth-server-url and no resolver/named-tenant fallback applies, it throws this ConfigurationException naming the exact property expected (e.g. quarkus.oidc.auth-server-url or quarkus.oidc.<tenant>.auth-server-url).

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:204

            if (oidcConfig.certificateChain().trustStoreFile().isPresent()) {
                return createTenantContextToVerifyCertChain(oidcConfig);
            }
        }

        try {
            if (oidcConfig.authServerUrl().isEmpty()) {
                if (DEFAULT_TENANT_ID.equals(oidcConfig.tenantId().get())) {
                    ArcContainer container = Arc.container();
                    if (container != null
                            && (container.instance(TenantConfigResolver.class).isAvailable() || checkNamedTenants)) {
                        LOG.debugf("Default tenant is not configured and will be disabled"
                                + " because either 'TenantConfigResolver' which will resolve tenant configurations is registered"
                                + " or named tenants are configured.");
                        oidcConfig.tenantEnabled = false;
                        return TenantConfigContext.createReady(new OidcProvider(null, null, null), oidcConfig);
                    }
                }
                throw new ConfigurationException(
                        "'" + getConfigPropertyForTenant(tenantId, "auth-server-url") + "' property must be configured");
            }
            OidcCommonUtils.verifyEndpointUrl(oidcConfig.authServerUrl().get());
            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, OidcUtils.isServiceApp(oidcConfig), true);
            verifyAllowedRoutes(oidcConfig, tenantId);
        } catch (ConfigurationException t) {
            return Uni.createFrom().failure(t);
        }

        if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo
                && !enableUserInfo(oidcConfig)) {
            throw new ConfigurationException(
                    "UserInfo is not required but UserInfo is expected to be the source of authorization roles");
        }
        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)
                && !enableUserInfo(oidcConfig)) {
            String propertyName = getConfigPropertyForTenant(tenantId, "token.verify-access-token-with-user-info");
            throw new ConfigurationException("UserInfo is not required but '%s' is enabled".formatted(propertyName));

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc.auth-server-url=<issuer url> (or quarkus.oidc.<tenant>.auth-server-url for a named tenant) as indicated in the message.
2. If you have no OIDC server yet, remove the quarkus-oidc dependency or disable the tenant with quarkus.oidc.tenant-enabled=false.
3. If tenant configs are meant to be supplied at runtime, register an OidcTenantConfigResolver bean so the static auth-server-url is not required.
4. Verify the property is present in the active profile (check config source / -Dquarkus.profile).

Example fix

// before (application.properties)
quarkus.oidc.tenant-enabled=true

// after
quarkus.oidc.auth-server-url=https://idp.example.com/realms/main

if (config.getProperty("quarkus.oidc.auth-server-url") == null) {
    throw new IllegalStateException("quarkus.oidc.auth-server-url must be set when quarkus-oidc is on the classpath");
}

When it happens

Trigger: Tenant is enabled and no TenantConfigResolver is registered, oidcConfig.authServerUrl().isEmpty(), and the early-return path for disabled/resolver-only configurations did not apply — i.e. quarkus.oidc.auth-server-url (or quarkus.oidc.<tenant>.auth-server-url) is missing while OIDC is active.

Common situations: Typo like quarkus.oidc.aut-server-url or wrong prefix; adding quarkus-oidc dependency without configuring it; referencing a named tenant (e.g. quarkus.oidc.partner.*) but forgetting its auth-server-url; config not loaded from the right profile (e.g. only in %prod when running dev).

Related errors

• Config property 'quarkus.mongodb.database' must be defined w
• Dynamic tenant ID cannot be same as the default tenant ID: %
• Both public key and certificate chain verification modes are
• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required but '%s' is enabled

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/913ff3ffc87f44c5. Report an issue: GitHub.