quarkusio/quarkus · error · ConfigurationException

The '%s' property can only be set to 'idtoken' for WEB_APP a

Error message

The '%s' property can only be set to 'idtoken' for WEB_APP application types

What it means

Roles can be resolved from the ID token only in WEB_APP applications, because only web-app flows receive an ID token. Setting roles.source=idtoken for a service (bearer) application is invalid since bearer tokens are access tokens, so Quarkus throws this ConfigurationException at tenant creation.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:293

                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "token.refresh-token-time-skew")
                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
            if (oidcConfig.logout().path().isPresent()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "logout.path") + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP + " application types");
            }
            if (oidcConfig.roles().source().isPresent()
                    && oidcConfig.roles().source().get() == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.idtoken) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "roles.source")
                                + "' property can only be set to 'idtoken' for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
        } else {
            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {
                oidcConfig.token.setRefreshExpired(true);
            }
            if (oidcConfig.authentication().sessionAgeExtension().isPresent()
                    && !oidcConfig.token().refreshExpired()) {
                LOG.warn(
                        "Session age extension will not be effective because 'quarkus.oidc.token.refresh-expired=true' is not set");
            }
            if (!oidcConfig.token().refreshExpired()
                    && !oidcConfig.token().refreshTokenCacheTimeToLive().isZero()) {
                throw new ConfigurationException(
                        "'" + getConfigPropertyForTenant(tenantId, "token.refresh-expired")

View on GitHub (pinned to e1c734241f)

Solutions

1. Set roles.source to accesstoken for service applications (roles read from the access token)
2. Remove roles.source and rely on the default for the application type
3. Change application-type to web-app if ID-token-based roles are intended

Example fix

// before
quarkus.oidc.application-type=service
quarkus.oidc.roles.source=idtoken
// after
quarkus.oidc.application-type=service
quarkus.oidc.roles.source=accesstoken

if (!"web-app".equals(appType) && config.roles().source().orElse(null) == Roles.Source.idtoken) {
    throw new IllegalArgumentException("roles.source=idtoken requires application-type=web-app");
}

boolean usesIdTokenRoles(OidcTenantConfig c) {
    return c.roles().source().orElse(null) == OidcTenantConfig.Roles.Source.idtoken;
}

When it happens

Trigger: oidcConfig.roles().source() == Source.idtoken while applicationType != WEB_APP during createTenantContext.

Common situations: Configuring quarkus.oidc.roles.source=idtoken in an API secured with bearer access tokens; copying web-app role config into a service tenant; misunderstanding that access-token is the correct source for service apps.

Related errors

• Access token is required to check the roles but DefaultToken
• UserInfo is not required but UserInfo is expected to be the
• '%s' must be enabled to use '%s'
• UserInfo is required but DefaultTokenStateManager is configu
• UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/410f13ce60564a1b. Report an issue: GitHub.