quarkusio/quarkus · error · ConfigurationException

UserInfo path is missing but 'verifyAccessTokenWithUserInfo'

Error message

UserInfo path is missing but 'verifyAccessTokenWithUserInfo' is enabled

What it means

With discovery disabled, Quarkus cannot learn the UserInfo endpoint from the provider's metadata, so it must be configured explicitly. If token.verify-access-token-with-user-info=true but no userinfoPath is set, the tenant context creation fails with this ConfigurationException.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:336

        if (oidcConfig.tokenStateManager()
                .strategy() != io.quarkus.oidc.runtime.OidcTenantConfig.TokenStateManager.Strategy.KEEP_ALL_TOKENS) {

            if (oidcConfig.authentication().userInfoRequired().orElse(false)
                    || oidcConfig.roles().source()
                            .orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.userinfo) {
                throw new ConfigurationException(
                        "UserInfo is required but DefaultTokenStateManager is configured to not keep the access token");
            }
            if (oidcConfig.roles().source().orElse(null) == io.quarkus.oidc.runtime.OidcTenantConfig.Roles.Source.accesstoken) {
                throw new ConfigurationException(
                        "Access token is required to check the roles but DefaultTokenStateManager is configured to not keep the access token");
            }
        }

        if (oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {
            if (!oidcConfig.discoveryEnabled().orElse(true)) {
                if (oidcConfig.userInfoPath().isEmpty()) {
                    throw new ConfigurationException(
                            "UserInfo path is missing but 'verifyAccessTokenWithUserInfo' is enabled");
                }
                if (oidcConfig.introspectionPath().isPresent()) {
                    throw new ConfigurationException(
                            "Introspection path is configured and 'verifyAccessTokenWithUserInfo' is enabled, these options are mutually exclusive");
                }
            }
        }

        if (!oidcConfig.token().issuedAtRequired() && oidcConfig.token().age().isPresent()) {
            String tokenIssuedAtRequired = getConfigPropertyForTenant(tenantId, "token.issued-at-required");
            String tokenAge = getConfigPropertyForTenant(tenantId, "token.age");
            throw new ConfigurationException(
                    "The '" + tokenIssuedAtRequired + "' can only be set to false if '" + tokenAge + "' is not set." +
                            " Either set '" + tokenIssuedAtRequired + "' to true or do not set '" + tokenAge + "'.",
                    Set.of(tokenIssuedAtRequired, tokenAge));
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Add quarkus.oidc.user-info-path=/userinfo (matching the provider's actual endpoint)
2. Re-enable discovery (quarkus.oidc.discovery-enabled=true) so the path is fetched from metadata
3. Disable token.verify-access-token-with-user-info if UserInfo verification is not needed

Example fix

// before
quarkus.oidc.discovery-enabled=false
quarkus.oidc.token.verify-access-token-with-user-info=true
// after
quarkus.oidc.discovery-enabled=false
quarkus.oidc.token.verify-access-token-with-user-info=true
quarkus.oidc.user-info-path=/userinfo

if (config.token().verifyAccessTokenWithUserInfo().orElse(false) && !config.discoveryEnabled().orElse(true)
        && config.userInfoPath().isEmpty()) {
    throw new IllegalArgumentException("user-info-path must be set when discovery is disabled");
}

When it happens

Trigger: verifyAccessTokenWithUserInfo().orElse(false) is true, discoveryEnabled().orElse(true) is false, and userInfoPath() is empty at createTenantContext.

Common situations: Hard-coded OIDC endpoints (discovery-enabled=false) without a userinfo-path; pointing at a provider that lacks well-known metadata; disabling discovery to avoid the startup discovery call.

Related errors

• UserInfo is required but '%s' is not configured.
• UserInfo is required but DefaultTokenStateManager is configu
• Authorization code flow access token which is required to ge
• UserInfo is not required but UserInfo is expected to be the
• UserInfo is not required but '%s' is enabled

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/0c5172b98c304838. Report an issue: GitHub.