quarkusio/quarkus · error · ConfigurationException

UserInfo is not required but '%s' is enabled

Error message

UserInfo is not required but '%s' is enabled

What it means

quarkus.oidc.token.verify-access-token-with-user-info makes Quarkus verify opaque/bearer access tokens via the UserInfo endpoint, but that verification can only happen if UserInfo is actually fetched (required). When the option is enabled on a non-web-app tenant without UserInfo being required, createTenantContext throws this ConfigurationException naming the offending property.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:222

                throw new ConfigurationException(
                        "'" + getConfigPropertyForTenant(tenantId, "auth-server-url") + "' property must be configured");
            }
            OidcCommonUtils.verifyEndpointUrl(oidcConfig.authServerUrl().get());
            OidcCommonUtils.verifyCommonConfiguration(oidcConfig, OidcUtils.isServiceApp(oidcConfig), true);
            verifyAllowedRoutes(oidcConfig, tenantId);
        } catch (ConfigurationException t) {
            return Uni.createFrom().failure(t);
        }

        if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo
                && !enableUserInfo(oidcConfig)) {
            throw new ConfigurationException(
                    "UserInfo is not required but UserInfo is expected to be the source of authorization roles");
        }
        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)
                && !enableUserInfo(oidcConfig)) {
            String propertyName = getConfigPropertyForTenant(tenantId, "token.verify-access-token-with-user-info");
            throw new ConfigurationException("UserInfo is not required but '%s' is enabled".formatted(propertyName));
        }
        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)
                && StepUpAuthenticationPolicy.isEnabled()) {
            String propertyName = getConfigPropertyForTenant(tenantId, "authentication.id-token-required");
            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not
            // required for this tenant, which we cannot know
            LOG.warnf("Step Up Authentication is not supported for tenant '%s', because the internal IdToken is"
                    + " generated by Quarkus. Please see the '%s' configuration property documentation for more information",
                    tenantId, propertyName);
        }
        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)
                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {
            throw new ConfigurationException(
                    "UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token"
                            .formatted(tenantId));
        }

        if (!oidcConfig.discoveryEnabled().orElse(true)) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc.authentication.user-info-required=true so UserInfo is fetched and can verify tokens.
2. Or remove quarkus.oidc.token.verify-access-token-with-user-info if the access token is a JWT verified via JWKS instead.
3. Or set application-type=web-app if the app really is a code-flow app.

Example fix

// before
quarkus.oidc.application-type=service
quarkus.oidc.token.verify-access-token-with-user-info=true

// after
quarkus.oidc.application-type=service
quarkus.oidc.token.verify-access-token-with-user-info=true
quarkus.oidc.authentication.user-info-required=true

if ("true".equals(config.getProperty("quarkus.oidc.token.verify-access-token-with-user-info"))
        && !"web-app".equals(config.getProperty("quarkus.oidc.application-type"))
        && !"true".equals(config.getProperty("quarkus.oidc.authentication.user-info-required"))) {
    throw new IllegalStateException("verify-access-token-with-user-info needs user-info-required=true for non web-app tenants");
}

When it happens

Trigger: createTenantContext finds oidcConfig.token().verifyAccessTokenWithUserInfo() == true while the tenant is not a web-app (OidcUtils.isWebApp false) and enableUserInfo(oidcConfig) is false — e.g. quarkus.oidc.token.verify-access-token-with-user-info=true set on a service/hybrid tenant without user-info-required=true.

Common situations: Enabling access-token-via-UserInfo verification for a Bearer-token (service) application; switching application-type from web-app to service and leaving the verify flag on; profile override that turns off user-info-required while the verify flag remains enabled.

Related errors

• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required for OIDC tenant '%s' but it will be
• UserInfo is required but '%s' is not configured.
• Multiple interface io.quarkus.oidc.UserInfo beans registered
• Authorization code flow access token which is required to ge

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9f1d04a9af382204. Report an issue: GitHub.