quarkusio/quarkus · error · IllegalStateException

Unsupported JWT source: <source>

Error message

Unsupported JWT source: <source>

What it means

KubernetesServiceClientAssertionProvider supports only a fixed set of JWT assertion sources (e.g. Kubernetes service-account token, SPIFFE JWT-SVID). Its constructor switches on the Source enum and throws IllegalStateException for any Source value it does not handle, indicating an internal configuration/mapping gap rather than a user input problem.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/KubernetesServiceClientAssertionProvider.java:43

    private static final Logger LOG = Logger.getLogger(KubernetesServiceClientAssertionProvider.class);
    private static final String SPIFFE_ID_SCHEME = "spiffe://";
    private final Vertx vertx;
    private final Path tokenPath;
    private final String clientAssertionType;
    private final String tokenType;
    volatile ClientAssertion clientAssertion;

    KubernetesServiceClientAssertionProvider(Vertx vertx, Path tokenPath, Source source) {
        this.vertx = vertx;
        this.tokenPath = tokenPath;
        if (source == Source.BEARER) {
            this.clientAssertionType = OidcConstants.JWT_BEARER_CLIENT_ASSERTION_TYPE;
            this.tokenType = "JWT bearer";
        } else if (source == Source.SPIFFE_JWT) {
            this.clientAssertionType = OidcConstants.SPIFFE_SVID_CLIENT_ASSERTION_TYPE;
            this.tokenType = "SPIFFE JWT-SVID";
        } else {
            throw new IllegalStateException("Unsupported JWT source: " + source);
        }
        this.clientAssertion = loadInitialClientAssertion();
    }

    @Override
    public Uni<String> getClientAssertion() {
        return Uni.createFrom().item(this::getAvailableClientAssertion);
    }

    String getAvailableClientAssertion() {
        ClientAssertion clientAssertion = this.clientAssertion;
        if (isInvalid(clientAssertion)) {
            clientAssertion = loadClientAssertion();
        }
        return clientAssertion == null ? null : clientAssertion.bearerToken;
    }

    @Override

View on GitHub (pinned to e1c734241f)

Solutions

1. Check your quarkus.oidc-client credentials.jwt configuration and use a supported assertion source (kubernetes service account token or SPIFFE SVID)
2. Upgrade Quarkus to a version where the configured source is supported
3. If you added a custom Source constant, add the corresponding branch mapping clientAssertionType/tokenType

Example fix

// before
jwt.source = custom-source // unsupported
// after
jwt.source = kubernetes-service-account-token (or spiffe) // supported sources only

if (source != Source.KUBERNETES_JWT && source != Source.SPIFFE_JWT) {
    throw new IllegalArgumentException("Unsupported JWT source: " + source);
}

boolean isSupportedSource(Source s) {
    return s == Source.KUBERNETES_JWT || s == Source.SPIFFE_JWT;
}

try {
    var provider = new KubernetesServiceClientAssertionProvider(source, ...);
} catch (IllegalStateException e) {
    LOG.error("Falling back to default client assertion: " + e.getMessage());
}

When it happens

Trigger: Constructing KubernetesServiceClientAssertionProvider with a Source enum value outside the handled branches (Kubernetes JWT / SPIFFE_JWT), typically when a new source kind is configured but the provider lacks a branch for it.

Common situations: Newer Quarkus configuration options introducing additional assertion sources with a mismatched/missing branch; internal misconfiguration of the JWT-bearer client assertion source for Kubernetes authentication.

Related errors

• %s type can not be used to represent JWT claims in @Singleto
• DPoP proof token signature is invalid
• Opaque access token can not be converted to JsonWebToken
• ISSUED_AT_INVALID_PAST
• JWK with kid '%s' is not available

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0e7dba2e0ae64f5e. Report an issue: GitHub.