quarkusio/quarkus · error · RuntimeException

/tenant-nonce is a configured callback method

Error message

/tenant-nonce is a configured callback method

What it means

Deliberate sentinel in TenantNonce: the /callback path is the configured OIDC redirect_uri for this tenant and must be handled by the OIDC extension itself, never by this JAX-RS method. If getTenantCallback executes, the OIDC code-flow callback was not intercepted — authentication completed unexpectedly or the callback path is not registered as the tenant's redirect path.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/TenantNonce.java:30

public class TenantNonce {

    @Inject
    OidcSession session;
    @Inject
    RoutingContext routingContext;

    @GET
    @Authenticated
    public String getTenant() {
        session.logout().await().indefinitely();
        return session.getTenantId() + (routingContext.get("reauthenticated") != null ? ":reauthenticated" : "");
    }

    @GET
    @Authenticated
    @Path("/callback")
    public String getTenantCallback() {
        throw new RuntimeException("/tenant-nonce is a configured callback method");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Set the tenant's redirect-path so the OIDC extension intercepts /tenant-nonce/callback
2. Ensure the callback request carries valid code and state parameters from the provider
3. Verify only the root /tenant-nonce resource is ever served to authenticated users

Example fix

// before
@GET
@Authenticated
@Path("/callback")
public String getTenantCallback() {
    throw new RuntimeException("/tenant-nonce is a configured callback method");
}
// after
// configure instead:
quarkus.oidc.tenant-nonce.redirect-path=/tenant-nonce/callback

// ensure OIDC intercepts the callback before it reaches JAX-RS
if (uri.getPath().endsWith("/tenant-nonce/callback") && securityIdentity.isAnonymous()) {
    // expected: OIDC extension handles this as the code-flow callback
}

try {
    given().get("/tenant-nonce/callback");
} catch (RuntimeException e) {
    // callback reached JAX-RS; check quarkus.oidc.tenant-nonce.redirect-path
}

When it happens

Trigger: A request arrives at /tenant-nonce/callback without the OIDC extension handling it as the code-flow callback (e.g. missing state/code, wrong redirect-path config, or authentication already completed).

Common situations: quarkus.oidc.<tenant>.redirect-path not set to /tenant-nonce/callback; testing that the callback is consumed by OIDC (nonce verification flow); hitting the callback URL directly in a browser.

Related errors

• Failed to generate key id
• Invalid Flyway callback. It shouldn't be abstract and must h
• Application 'web-app' type is only supported if access token
• Failed to parse the realm name.
• Failed to find a matching OidcTenantConfig for tenant:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f6747c589be53fa8. Report an issue: GitHub.