Repository: quarkusio/quarkus
Issue: Multitenancy OIDC permit tenant enumeration

### Describe the bug

We have a multi tenant application which programmatically choose the tenant based in the URL path.  However, unauthorized users are able to find out tenant names because if the OIDC server is down (not exists in this case) it return a 500 error messag. But if OIDC server exists it will return a 401.   

### Expected behavior

To avoid tenant enumeration both requests should return the same status code (401 or 404). 

### Actual behavior

The framework return 500 if server is down (or not exits) 

### How to Reproduce?

1. Create a project with OIDC and Keycloak as dev service.
2. Configure a multi tenant architecture to [resolve tenant in URL path](https://quarkus.io/guides/security-openid-connect-multitenancy#tenant-config-resolver). 
3. Try to access a nonexistence tenant with any credentials, it will return 500 
4. Try to access a existence tenant with any credentials, it will return 401

### Output of `uname -a` or `ver`

_No response_

### Output of `java -version`

_No response_

### GraalVM version (if different from Java)

_No response_

### Quarkus version or git rev

_No response_

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)

_No response_

### Additional information

I tried to workaround the issue by using exception mapper but it not worked. (Method was not called) 

Changed files:
extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CustomTenantConfigResolver.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java
extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CodeFlowDevModeTestCase.java

diff --git a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CodeFlowDevModeTestCase.java b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CodeFlowDevModeTestCase.java
index 00e003db3d7..410c8ee4f92 100644
--- a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CodeFlowDevModeTestCase.java
+++ b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CodeFlowDevModeTestCase.java
@@ -124,6 +124,18 @@ private void useTenantConfigResolver() throws IOException, InterruptedException
 
             assertEquals("tenant-config-resolver:alice", page.getBody().asNormalizedText());
             webClient.getCookieManager().clearCookies();
+            try {
+                webClient.getPage("http://localhost:8080/protected/tenant/null-tenant");
+                fail("401 status error is expected");
+            } catch (FailingHttpStatusCodeException ex) {
+                assertEquals(401, ex.getStatusCode());
+            }
+            try {
+                webClient.getPage("http://localhost:8080/protected/tenant/unknown-tenant");
+                fail("401 status error is expected");
+            } catch (FailingHttpStatusCodeException ex) {
+                assertEquals(401, ex.getStatusCode());
+            }
         }
     }
 
diff --git a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CustomTenantConfigResolver.java b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CustomTenantConfigResolver.java
index 9bba5cbd1c8..4b88cadd8a7 100644
--- a/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CustomTenantConfigResolver.java
+++ b/extensions/oidc/deployment/src/test/java/io/quarkus/oidc/test/CustomTenantConfigResolver.java
@@ -22,6 +22,9 @@ public Uni<OidcTenantConfig> resolve(RoutingContext context, OidcRequestContext<
             config.setApplicationType(ApplicationType.WEB_APP);
             return Uni.createFrom().item(config);
         }
+        if (context.request().path().endsWith("/null-tenant")) {
+            return null;
+        }
         return Uni.createFrom().nullItem();
     }
 
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java
index 721ab284016..946a02998de 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/DefaultTenantConfigResolver.java
@@ -185,7 +185,12 @@ private Uni<OidcTenantConfig> getDynamicTenantConfig(RoutingContext context) {
         if (tenantConfigResolver.isResolvable()) {
             Uni<OidcTenantConfig> oidcConfig = context.get(CURRENT_DYNAMIC_TENANT_CONFIG);
             if (oidcConfig == null) {
-                oidcConfig = tenantConfigResolver.get().resolve(context, blockingRequestContext).memoize().indefinitely();
+                oidcConfig = tenantConfigResolver.get().resolve(context, blockingRequestContext);
+                if (oidcConfig == null) {
+                    //shouldn't happen, but guard against it anyway
+                    oidcConfig = Uni.createFrom().nullItem();
+                }
+                oidcConfig = oidcConfig.memoize().indefinitely();
                 if (oidcConfig == null) {
                     //shouldn't happen, but guard against it anyway
                     oidcConfig = Uni.createFrom().nullItem();