quarkusio/quarkus · error · RuntimeException

/tenant-absolute-redirect/callback is a callback method

Error message

/tenant-absolute-redirect/callback is a callback method

What it means

Deliberate sentinel in TenantAbsoluteRedirect. The root path of this resource must never serve a response; only its /callback sub-path is legitimate (it is the OIDC redirect_uri for the tenant-absolute-redirect tenant). If the root endpoint executes, the OIDC flow redirected the user to the wrong path — the callback URL instead of the protected resource.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantAbsoluteRedirect.java:19

package io.quarkus.it.keycloak;

import jakarta.ws.rs.GET;
import jakarta.ws.rs.Path;
import jakarta.ws.rs.core.Context;
import jakarta.ws.rs.core.UriInfo;

import io.quarkus.security.Authenticated;

@Path("/tenant-absolute-redirect")
public class TenantAbsoluteRedirect {

    @Context
    UriInfo ui;

    @GET
    @Authenticated
    public String getTenant() {
        throw new RuntimeException("/tenant-absolute-redirect/callback is a callback method");
    }

    @GET
    @Authenticated
    @Path("/callback")
    public String getTenantCallback() {
        return ui.getAbsolutePath().toString();
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Fix the tenant's redirect-path so Keycloak redirects to /tenant-absolute-redirect/callback only
Verify the Keycloak client's valid redirect URIs match the configured callback path
Ensure the authenticated root resource is only requested after a completed callback

Example fix

// before
public String getTenant() {
    throw new RuntimeException("/tenant-absolute-redirect/callback is a callback method");
}
// after
// Configure the tenant so only /callback is the redirect target:
quarkus.oidc.tenant-absolute-redirect.redirect-path=/tenant-absolute-redirect/callback

Defensive patterns

Strategy: validation

Validate before calling

// assert the OIDC redirect target is the callback path, not the resource root
if (!redirectUri.endsWith("/tenant-absolute-redirect/callback")) {
    throw new IllegalStateException("redirect must target the callback path");
}

Try / catch

try {
    given().get("/tenant-absolute-redirect");
} catch (RuntimeException e) {
    // root endpoint invoked: fix quarkus.oidc.*.redirect-path config
}

Prevention

Configure redirect-path to point only at the /callback sub-path
Match Keycloak client valid-redirect-URIs with the configured callback
Never request the protected root directly during flow tests

When it happens

Trigger: The tenant's redirect-uri / absolute redirect path is misconfigured so the OIDC callback lands on the resource root instead of /tenant-absolute-redirect/callback.

Common situations: Wrong quarkus.oidc.<tenant>.redirect-path or absolute redirect URI in Keycloak client config; testing that only the callback method is ever invoked; copy-paste of tenant configs with stale paths.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/7bddf16cc11c0dd1. Report an issue: GitHub.