quarkusio/quarkus · error · ConfigurationException

The OIDC proxy configuration currently does not support the

Error message

The OIDC proxy configuration currently does not support the 'quarkus.proxy."<name>".non-proxy-hosts' property

What it means

Quarkus OIDC builds a Vert.x proxy configuration from a named proxy registry entry ('quarkus.proxy."<name>".*'). The OIDC client only maps host, port, username, password and connect timeout; a non-proxy-hosts list cannot be honored, so the library fails fast at startup with a ConfigurationException rather than silently ignoring it.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:396

            ProxyConfigurationRegistry proxyConfigurationRegistry) {
        if (oidcProxyConfig.proxyConfigurationName().isEmpty()) {
            return Optional.empty();
        }

        var maybeProxyConfig = proxyConfigurationRegistry.get(oidcProxyConfig.proxyConfigurationName());
        if (maybeProxyConfig.isEmpty()) {
            throw new ConfigurationException("Cannot find the Proxy registry configuration '%s'"
                    .formatted(oidcProxyConfig.proxyConfigurationName().get()));
        }

        var proxyRegistryConfig = maybeProxyConfig.get().assertHttpType();
        final String hostProperty = proxyRegistryConfig.host();
        final int portProperty = proxyRegistryConfig.port();
        final Optional<String> usernameProperty = proxyRegistryConfig.username();
        final Optional<String> passwordProperty = proxyRegistryConfig.password();
        final Optional<Duration> proxyConnectTimeoutProperty = proxyRegistryConfig.proxyConnectTimeout();
        if (proxyRegistryConfig.nonProxyHosts().isPresent()) {
            throw new ConfigurationException(
                    "The OIDC proxy configuration currently does not support the 'quarkus.proxy.\""
                            + oidcProxyConfig.proxyConfigurationName().get() + "\".non-proxy-hosts' property");
        }

        JsonObject jsonOptions = new JsonObject();
        // Vert.x Client currently does not expect a host having a scheme but keycloak-authorization expects scheme and host.
        // Having a dedicated scheme property is probably better, but since it is property is not taken into account in Vertx Client
        // it does not really make sense as it can send a misleading message that users can choose between `http` and `https`.
        String host = URI.create(hostProperty).getHost();
        if (host == null) {
            host = hostProperty;
        }
        jsonOptions.put("host", host);
        jsonOptions.put("port", portProperty);
        if (usernameProperty.isPresent()) {
            jsonOptions.put("username", usernameProperty.get());
        }
        if (passwordProperty.isPresent()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the non-proxy-hosts entry from the quarkus.proxy."<name>" configuration used by OIDC
2. Route OIDC traffic through the proxy for all hosts (accept no exclusions), or point the OIDC config at a second proxy entry without non-proxy-hosts
3. If the OIDC endpoint must bypass the proxy, run with JVM-wide proxy exclusions (http.nonProxyHosts) or disable proxying for OIDC instead
4. Upgrade Quarkus and check release notes/issue tracker for OIDC non-proxy-hosts support before re-adding the property

Example fix

// before
quarkus.proxy."corp".host=proxy.corp.com
quarkus.proxy."corp".port=3128
quarkus.proxy."corp".non-proxy-hosts=internal.corp.com
// after
quarkus.proxy."corp".host=proxy.corp.com
quarkus.proxy."corp".port=3128
// non-proxy-hosts removed - not supported for OIDC

if (ConfigProvider.getConfig().getOptionalValue("quarkus.proxy.\"corp\".non-proxy-hosts", String.class).isPresent()) {
    throw new IllegalStateException("Remove quarkus.proxy non-proxy-hosts: unsupported for OIDC");
}

When it happens

Trigger: Setting quarkus.proxy."<proxy-name>".non-proxy-hosts (or equivalent OidcProxyConfig referencing a proxy registry entry with non-proxy-hosts present) while an OIDC/OIDC-client extension resolves that proxy via toProxyOptions at startup.

Common situations: Copy-pasting a corporate proxy config that includes nonProxyHosts into the quarkus.proxy block used by OIDC; reusing an existing proxy config shared with other Quarkus components (e.g. HTTP client proxy) that support non-proxy-hosts.

Related errors

• Either 'quarkus.oidc-client.auth-server-url' or absolute 'qu
• configuration id '<key>' duplicates the default configuratio
• The 'quarkus.hibernate-orm.mapping.format.global' configurat
• Annotation '%s' placed on '%s' specifies no 'acr' value
• The '%s' annotation is only supported when proactive authent

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8c6d67439eb9d7ef. Report an issue: GitHub.