quarkusio/quarkus · error · ConfigurationException

UserInfo is not required for OIDC tenant '%s' but it will be

Error message

UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token

What it means

A tenant can declare that no ID token is required (e.g. pure access-token flows). However, if code flow access tokens are configured to be verified with UserInfo, that verification still needs UserInfo — which in turn usually requires the ID token. createTenantContext throws this ConfigurationException when idTokenRequired=false, user-info not enabled, and verifyAccessTokenWithUserInfo=true, since the combination cannot work.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:235

                    "UserInfo is not required but UserInfo is expected to be the source of authorization roles");
        }
        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false) && !OidcUtils.isWebApp(oidcConfig)
                && !enableUserInfo(oidcConfig)) {
            String propertyName = getConfigPropertyForTenant(tenantId, "token.verify-access-token-with-user-info");
            throw new ConfigurationException("UserInfo is not required but '%s' is enabled".formatted(propertyName));
        }
        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && OidcUtils.isWebApp(oidcConfig)
                && StepUpAuthenticationPolicy.isEnabled()) {
            String propertyName = getConfigPropertyForTenant(tenantId, "authentication.id-token-required");
            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not
            // required for this tenant, which we cannot know
            LOG.warnf("Step Up Authentication is not supported for tenant '%s', because the internal IdToken is"
                    + " generated by Quarkus. Please see the '%s' configuration property documentation for more information",
                    tenantId, propertyName);
        }
        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)
                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {
            throw new ConfigurationException(
                    "UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token"
                            .formatted(tenantId));
        }

        if (!oidcConfig.discoveryEnabled().orElse(true)) {
            if (!OidcUtils.isServiceApp(oidcConfig)) {
                if (oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty()) {
                    String authorizationPathProperty = getConfigPropertyForTenant(tenantId, "authorization-path");
                    String tokenPathProperty = getConfigPropertyForTenant(tenantId, "token-path");
                    throw new ConfigurationException(
                            "'web-app' applications must have '" + authorizationPathProperty + "' and '" + tokenPathProperty
                                    + "' properties "
                                    + "set when the discovery is disabled.",
                            Set.of(authorizationPathProperty, tokenPathProperty));
                }
            }
            // JWK and introspection endpoints have to be set for both 'web-app' and 'service' applications
            if (oidcConfig.jwksPath().isEmpty() && oidcConfig.introspectionPath().isEmpty()) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove quarkus.oidc.token.verify-access-token-with-user-info=true, or verify the access token via JWKS/introspection instead.
2. Or re-enable the ID token (quarkus.oidc.authentication.id-token-required=true) so the code flow token chain works.
3. Or enable UserInfo properly (user-info-required=true) if UserInfo-dependent verification is genuinely intended.

Example fix

// before
quarkus.oidc.authentication.id-token-required=false
quarkus.oidc.token.verify-access-token-with-user-info=true

// after
quarkus.oidc.authentication.id-token-required=false

boolean idTokenRequired = Optional.ofNullable(config.getProperty("quarkus.oidc.authentication.id-token-required"))
        .map(Boolean::parseBoolean).orElse(true);
boolean verifyViaUserInfo = "true".equals(config.getProperty("quarkus.oidc.token.verify-access-token-with-user-info"));
if (!idTokenRequired && verifyViaUserInfo) {
    throw new IllegalStateException("verify-access-token-with-user-info cannot be used with id-token-required=false");
}

When it happens

Trigger: createTenantContext sees oidcConfig.authentication().idTokenRequired() == false, enableUserInfo(oidcConfig) == false, and oidcConfig.token().verifyAccessTokenWithUserInfo() == true — e.g. quarkus.oidc.authentication.id-token-required=false together with quarkus.oidc.token.verify-access-token-with-user-info=true.

Common situations: Trying to accept only access tokens and disabling the ID token while leaving UserInfo-based access-token verification on; simplifying config to drop the ID token without noticing the token-verification dependency.

Related errors

• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required but '%s' is enabled
• UserInfo is required but '%s' is not configured.
• Multiple interface io.quarkus.oidc.UserInfo beans registered
• Authorization code flow access token which is required to ge

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/510278b06dc94ce6. Report an issue: GitHub.