quarkusio/quarkus · error · ConfigurationException

UserInfo is required but '%s' is not configured.

Error message

UserInfo is required but '%s' is not configured.

What it means

When UserInfo is required (quarkus.oidc.authentication.user-info-required=true) but discovery is disabled, Quarkus must be told explicitly where the UserInfo endpoint is. createTenantContext throws this ConfigurationException when userInfoRequired is true and user-info-path is empty, naming the expected property (quarkus.oidc.user-info-path or its tenant-scoped form).

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:265

                                    + "' properties "
                                    + "set when the discovery is disabled.",
                            Set.of(authorizationPathProperty, tokenPathProperty));
                }
            }
            // JWK and introspection endpoints have to be set for both 'web-app' and 'service' applications
            if (oidcConfig.jwksPath().isEmpty() && oidcConfig.introspectionPath().isEmpty()) {
                if (!oidcConfig.authentication().idTokenRequired().orElse(true)
                        && oidcConfig.authentication().userInfoRequired().orElse(false)) {
                    LOG.debugf("tenant %s supports only UserInfo", oidcConfig.tenantId().get());
                } else if (OidcUtils.isServiceApp(oidcConfig)) {
                    throw new ConfigurationException(
                            "Either 'jwks-path' or 'introspection-path' properties must be set when the discovery is disabled.",
                            Set.of("quarkus.oidc.jwks-path", "quarkus.oidc.introspection-path"));
                }
            }
            if (oidcConfig.authentication().userInfoRequired().orElse(false) && oidcConfig.userInfoPath().isEmpty()) {
                String configProperty = getConfigPropertyForTenant(tenantId, "user-info-path");
                throw new ConfigurationException(
                        "UserInfo is required but '" + configProperty + "' is not configured.",
                        Set.of(configProperty));
            }
        }

        if (OidcUtils.isServiceApp(oidcConfig)) {
            if (oidcConfig.token().refreshExpired()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "token.refresh-expired")
                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP
                                + " application types");
            }
            if (oidcConfig.token().refreshTokenTimeSkew().isPresent()) {
                throw new ConfigurationException(
                        "The '" + getConfigPropertyForTenant(tenantId, "token.refresh-token-time-skew")
                                + "' property can only be enabled for "
                                + io.quarkus.oidc.runtime.OidcTenantConfig.ApplicationType.WEB_APP

View on GitHub (pinned to e1c734241f)

Solutions

1. Set quarkus.oidc.user-info-path (e.g. /protocol/openid-connect/userinfo) for the tenant.
2. Or re-enable discovery (quarkus.oidc.discovery-enabled=true) if the provider publishes the well-known config.
3. Or remove quarkus.oidc.authentication.user-info-required=true if UserInfo is not actually needed.

Example fix

// before
quarkus.oidc.discovery-enabled=false
quarkus.oidc.authentication.user-info-required=true

// after
quarkus.oidc.discovery-enabled=false
quarkus.oidc.authentication.user-info-required=true
quarkus.oidc.user-info-path=/protocol/openid-connect/userinfo

boolean userInfoRequired = "true".equals(config.getProperty("quarkus.oidc.authentication.user-info-required"));
boolean discoveryDisabled = "false".equals(config.getProperty("quarkus.oidc.discovery-enabled"));
if (userInfoRequired && discoveryDisabled && config.getProperty("quarkus.oidc.user-info-path") == null) {
    throw new IllegalStateException("user-info-path is required when user-info-required=true and discovery is disabled");
}

When it happens

Trigger: createTenantContext finds oidcConfig.authentication().userInfoRequired() == true, oidcConfig.userInfoPath().isEmpty(), and discoveryEnabled() == false — i.e. user-info-required=true with quarkus.oidc.discovery-enabled=false and no quarkus.oidc.user-info-path.

Common situations: Adding user-info-required=true to a tenant whose config already had discovery disabled; IdP lacks the well-known endpoint and user-info-path was never set; profile merges that turned discovery off while keeping user-info-required.

Related errors

• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required but '%s' is enabled
• UserInfo is not required for OIDC tenant '%s' but it will be
• 'web-app' applications must have '%s' and '%s' properties se
• Either 'jwks-path' or 'introspection-path' properties must b

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/8707e872a53aaf60. Report an issue: GitHub.