quarkusio/quarkus · error · ConfigurationException

'web-app' applications must have '%s' and '%s' properties se

Error message

'web-app' applications must have '%s' and '%s' properties set when the discovery is disabled.

What it means

With OIDC discovery disabled, Quarkus cannot locate the provider's authorization and token endpoints automatically. Web-app (code flow) applications need both endpoints to run the login flow. createTenantContext throws this ConfigurationException when discovery is off, the tenant is not a service app, and either authorization-path or token-path is missing.

Source

Thrown at extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/TenantContextFactory.java:245

            // this can be false alarm in case Quarkus application have multiple tenants and 'acr' values are not
            // required for this tenant, which we cannot know
            LOG.warnf("Step Up Authentication is not supported for tenant '%s', because the internal IdToken is"
                    + " generated by Quarkus. Please see the '%s' configuration property documentation for more information",
                    tenantId, propertyName);
        }
        if (!oidcConfig.authentication().idTokenRequired().orElse(true) && !enableUserInfo(oidcConfig)
                && oidcConfig.token().verifyAccessTokenWithUserInfo().orElse(false)) {
            throw new ConfigurationException(
                    "UserInfo is not required for OIDC tenant '%s' but it will be needed to verify a code flow access token"
                            .formatted(tenantId));
        }

        if (!oidcConfig.discoveryEnabled().orElse(true)) {
            if (!OidcUtils.isServiceApp(oidcConfig)) {
                if (oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty()) {
                    String authorizationPathProperty = getConfigPropertyForTenant(tenantId, "authorization-path");
                    String tokenPathProperty = getConfigPropertyForTenant(tenantId, "token-path");
                    throw new ConfigurationException(
                            "'web-app' applications must have '" + authorizationPathProperty + "' and '" + tokenPathProperty
                                    + "' properties "
                                    + "set when the discovery is disabled.",
                            Set.of(authorizationPathProperty, tokenPathProperty));
                }
            }
            // JWK and introspection endpoints have to be set for both 'web-app' and 'service' applications
            if (oidcConfig.jwksPath().isEmpty() && oidcConfig.introspectionPath().isEmpty()) {
                if (!oidcConfig.authentication().idTokenRequired().orElse(true)
                        && oidcConfig.authentication().userInfoRequired().orElse(false)) {
                    LOG.debugf("tenant %s supports only UserInfo", oidcConfig.tenantId().get());
                } else if (OidcUtils.isServiceApp(oidcConfig)) {
                    throw new ConfigurationException(
                            "Either 'jwks-path' or 'introspection-path' properties must be set when the discovery is disabled.",
                            Set.of("quarkus.oidc.jwks-path", "quarkus.oidc.introspection-path"));
                }
            }
            if (oidcConfig.authentication().userInfoRequired().orElse(false) && oidcConfig.userInfoPath().isEmpty()) {

View on GitHub (pinned to e1c734241f)

Solutions

Set both quarkus.oidc.authorization-path and quarkus.oidc.token-path (the message lists the exact property names) to the provider's endpoint paths.
Or re-enable discovery (quarkus.oidc.discovery-enabled=true) if the provider exposes the well-known configuration.
If the app only uses bearer tokens, set quarkus.oidc.application-type=service so only jwks-path/introspection-path is required.

Example fix

// before
quarkus.oidc.discovery-enabled=false
quarkus.oidc.token-path=/protocol/openid-connect/token

// after
quarkus.oidc.discovery-enabled=false
quarkus.oidc.authorization-path=/protocol/openid-connect/auth
quarkus.oidc.token-path=/protocol/openid-connect/token

Defensive patterns

Strategy: validation

Validate before calling

if ("false".equals(config.getProperty("quarkus.oidc.discovery-enabled"))
        && (config.getProperty("quarkus.oidc.authorization-path") == null
            || config.getProperty("quarkus.oidc.token-path") == null)) {
    throw new IllegalStateException("web-app tenants need authorization-path and token-path when discovery is disabled");
}

Prevention

Whenever disabling discovery, configure authorization-path, token-path, and jwks-path/introspection-path in the same commit.
Verify endpoint paths against the IdP documentation before deploying.
Consider enabling discovery first and only disabling it when the provider genuinely lacks the well-known endpoint.

When it happens

Trigger: createTenantContext finds oidcConfig.discoveryEnabled() == false, OidcUtils.isServiceApp(oidcConfig) == false, and oidcConfig.authorizationPath().isEmpty() || oidcConfig.tokenPath().isEmpty() — i.e. quarkus.oidc.discovery-enabled=false without quarkus.oidc.authorization-path and quarkus.oidc.token-path on a web-app tenant.

Common situations: Disabling discovery for a legacy IdP without a well-known endpoint but only setting token-path; Keycloak behind a proxy that blocks /.well-known/openid-configuration so discovery was turned off; migrating a service config to web-app and inheriting the discovery-disabled setting.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/6c94d7cd09e5b9ea. Report an issue: GitHub.