quarkusio/quarkus · error · ConfigurationException

When using a key store, the `quarkus.oidc-client.credentials

Error message

When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set

What it means

When JWT client credentials are loaded from a Java key store, each stored key is protected by a separate key password distinct from the store password. Quarkus requires quarkus.oidc-client.credentials.jwt.key-password to retrieve the PrivateKey; without it a ConfigurationException is thrown.

Source

Thrown at extensions/oidc-common/runtime/src/main/java/io/quarkus/oidc/common/runtime/OidcCommonUtils.java:534

                            getSignatureAlgorithm(creds, SignatureAlgorithm.RS256));
                } else if (creds.jwt().keyFile().isPresent()) {
                    key = KeyUtils.readSigningKey(creds.jwt().keyFile().get(), creds.jwt().keyId().orElse(null),
                            getSignatureAlgorithm(creds, SignatureAlgorithm.RS256));
                } else if (creds.jwt().keyStoreFile().isPresent()) {
                    var keyStoreFile = creds.jwt().keyStoreFile().get();
                    KeyStore ks = KeyStore.getInstance(inferKeyStoreTypeFromFileExtension(keyStoreFile));
                    InputStream is = ResourceUtils.getResourceStream(keyStoreFile);

                    if (creds.jwt().keyStorePassword().isPresent()) {
                        ks.load(is, creds.jwt().keyStorePassword().get().toCharArray());
                    } else {
                        ks.load(is, null);
                    }

                    if (creds.jwt().keyPassword().isPresent()) {
                        key = ks.getKey(creds.jwt().keyId().get(), creds.jwt().keyPassword().get().toCharArray());
                    } else {
                        throw new ConfigurationException(
                                "When using a key store, the `quarkus.oidc-client.credentials.jwt.key-password` property must be set");
                    }
                }
            } catch (Exception ex) {
                throw new ConfigurationException("Key can not be loaded", ex);
            }
            if (key == null) {
                throw new ConfigurationException("Key is null");
            }
            return Uni.createFrom().item(key);
        }
    }

    public static String signJwtWithKey(OidcClientCommonConfig oidcConfig, String tokenRequestUri, Key key) {
        // 'jti' and 'iat' claims are created by default, 'iat' - is set to the current time
        JwtSignatureBuilder jwtSignatureBuilder = Jwt
                .claims(additionalClaims(oidcConfig.credentials().jwt().claims()))
                .issuer(oidcConfig.credentials().jwt().issuer().orElse(oidcConfig.clientId().get()))

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.oidc-client.credentials.jwt.key-password=<entry key password>
If the key entry password equals the store password, still set key-password explicitly to that value
Alternatively, avoid a key store: load the key from a PEM key file via credentials.jwt.key-file instead

Example fix

// before
quarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks
quarkus.oidc-client.credentials.jwt.key-store-password=storepass
// after
quarkus.oidc-client.credentials.jwt.key-store-file=classpath:keystore.jks
quarkus.oidc-client.credentials.jwt.key-store-password=storepass
quarkus.oidc-client.credentials.jwt.key-password=keypass

Defensive patterns

Strategy: validation

Validate before calling

if (ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.key-store-file", String.class).isPresent()
    && ConfigProvider.getConfig().getOptionalValue("quarkus.oidc-client.credentials.jwt.key-password", String.class).isEmpty()) {
    throw new IllegalStateException("key-store-file set but credentials.jwt.key-password missing");
}

Prevention

Always set key-password alongside key-store-file
Store both passwords in the same secret store/config profile
Document key store creation parameters (store vs key password) for your team

When it happens

Trigger: quarkus.oidc-client.credentials.jwt.key-store-file is set (key store loaded successfully) but credentials.jwt.key-password is absent when clientJwtKey calls ks.getKey(...) via initClientJwtKey.

Common situations: Setting the key store path and store password but forgetting the per-entry key password; assuming key password equals store password and omitting it.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/51e1e60e59a581e9. Report an issue: GitHub.