quarkusio/quarkus · error · ConfigurationException

The '%s' property can only be enabled for WEB_APP applicatio

Error message

The '%s' property can only be enabled for WEB_APP application types

What it means

Refreshing expired access tokens requires an authenticated browser session with a refresh token, which only exists for code-flow (WEB_APP) applications. Bearer-token (service) applications have no refresh token, so quarkus.oidc.token.refresh-expired (or a provided refresh-token-time-skew) is invalid there. createTenantContext throws this ConfigurationException for service apps with refresh-enabled settings.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:273

                        && oidcConfig.authentication().userInfoRequired().orElse(false)) {
                    LOG.debugf("tenant %s supports only UserInfo", oidcConfig.tenantId().get());
                } else if (OidcUtils.isServiceApp(oidcConfig)) {
                    throw new ConfigurationException(
                            "Either 'jwks-path' or 'introspection-path' properties must be set when the discovery is disabled.",
                            Set.of("quarkus.oidc.jwks-path", "quarkus.oidc.introspection-path"));
                }
            }
            if (oidcConfig.authentication().userInfoRequired().orElse(false) && oidcConfig.userInfoPath().isEmpty()) {
                String configProperty = getConfigPropertyForTenant(tenantId, "user-info-path");
                throw new ConfigurationException(
                        "UserInfo is required but '" + configProperty + "' is not configured.",
                        Set.of(configProperty));
            }
        }

        if (OidcUtils.isServiceApp(oidcConfig)) {
            if (oidcConfig.token().refreshExpired()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "token.refresh-expired")
                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "token.refresh-token-time-skew")
                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
            if (oidcConfig.logout().path().isPresent()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "logout.path") + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP + " application types");
            }
            if (oidcConfig.roles().source().isPresent()

View on GitHub (pinned to e1c734241f)

Solutions

Remove quarkus.oidc.token.refresh-expired=true (and token.refresh-token-time-skew) from service tenants.
Or set quarkus.oidc.application-type=web-app if the application really performs code flow and holds refresh tokens.
Or move the refresh settings to a tenant-specific scope (quarkus.oidc.<tenant>.token.refresh-expired) used only by web-app tenants.

Example fix

// before
quarkus.oidc.application-type=service
quarkus.oidc.token.refresh-expired=true

// after
quarkus.oidc.application-type=service
quarkus.oidc.token.refresh-expired=false

Defensive patterns

Strategy: validation

Validate before calling

String appType = config.getProperty("quarkus.oidc.application-type");
boolean refreshEnabled = "true".equals(config.getProperty("quarkus.oidc.token.refresh-expired"));
if (refreshEnabled && (appType == null || appType.equals("service"))) {
    throw new IllegalStateException("token.refresh-expired is only valid for application-type=web-app");
}

Prevention

Enable token refresh only in web-app tenant blocks.
Remember refresh requires a refresh token, which only code flow provides.
Review global quarkus.oidc.* settings that implicitly apply to service tenants.
Re-check token options whenever application-type changes.

When it happens

Trigger: createTenantContext finds OidcUtils.isServiceApp(oidcConfig) == true and either oidcConfig.token().refreshExpired() is true (quarkus.oidc.token.refresh-expired=true) or oidcConfig.token().refreshTokenTimeSkew().isPresent(), on a service application type tenant.

Common situations: Setting application-type=service (or leaving the default when only bearer tokens are used) while copying web-app token settings; enabling refresh-expired globally in quarkus.oidc.* while the app is a service app; a shared base config enabling refresh for all tenants.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/edf989b420475431. Report an issue: GitHub.