Repository: quarkusio/quarkus
Issue: OIDC Client stopped working and fails with 500 Internal Server

**Describe the bug**
Having this configuration:

```
# Security
quarkus.oidc.auth-server-url=http://localhost:8180/auth/realms/test-realm
quarkus.oidc.client-id=test-application-client
quarkus.oidc.credentials.secret=test-application-client-secret
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated
org.eclipse.microprofile.rest.client.propagateHeaders=Authorization

# OIDC Client Configuration
quarkus.oidc-client.auth-server-url=http://localhost:8180/auth/realms/test-realm
quarkus.oidc-client.client-id=test-application-client
quarkus.oidc-client.credentials.secret=test-application-client-secret
```

And this REALM configuration for Keycloak:

```
"clients": [
    {
      "clientId": "test-application-client",
      "enabled": true,
      "protocol": "openid-connect",
      "standardFlowEnabled": true,
      "implicitFlowEnabled": false,
      "directAccessGrantsEnabled": true,
      "serviceAccountsEnabled": true,
      "clientAuthenticatorType": "client-secret",
      "secret": "test-application-client-secret",
      "redirectUris": [
        "*"
      ]
    }
```

When running our application, it fails with the next exception:

```
2021-03-03 15:34:06,728 ERROR [io.qua.ver.htt.run.QuarkusErrorHandler] (vert.x-eventloop-thread-14) HTTP Request to /rest-pong failed, error id: b24d56d4-cfff-46e3-95e2-b9739e981896-5: io.vertx.core.VertxException: Invalid url: null
	at io.vertx.ext.web.client.impl.WebClientBase.requestAbs(WebClientBase.java:256)
	at io.vertx.ext.web.client.impl.WebClientBase.requestAbs(WebClientBase.java:246)
	at io.vertx.ext.web.client.impl.WebClientBase.postAbs(WebClientBase.java:176)
	at io.vertx.mutiny.ext.web.client.WebClient.postAbs(WebClient.java:334)
	at io.quarkus.oidc.runtime.OidcProviderClient.getHttpResponse(OidcProviderClient.java:95)
	at io.quarkus.oidc.runtime.OidcProviderClient.introspectToken(OidcProviderClient.java:63)
	at io.quarkus.oidc.runtime.OidcProvider.introspectToken(OidcProvider.java:115)
	at io.quarkus.oidc.runtime.OidcIdentityProvider.introspectTokenUni(OidcIdentityProvider.java:275)
	at io.quarkus.oidc.runtime.OidcIdentityProvider.verifyTokenUni(OidcIdentityProvider.java:251)
	at io.quarkus.oidc.runtime.OidcIdentityProvider.createSecurityIdentityWithOidcServer(OidcIdentityProvider.java:122)
	at io.quarkus.oidc.runtime.OidcIdentityProvider.access$200(OidcIdentityProvider.java:34)
	at io.quarkus.oidc.runtime.OidcIdentityProvider$3.apply(OidcIdentityProvider.java:115)
	at io.quarkus.oidc.runtime.OidcIdentityProvider$3.apply(OidcIdentityProvider.java:109)
```

Our project was working fine before these changes were merged: https://github.com/quarkusio/quarkus/pull/14953. So, this is a regression issue.

**To Reproduce**
1- git clone https://github.com/quarkus-qe/beefy-scenarios
2- cd beefy-scenarios/013-quarkus-oidc-restclient
4- mvn clean install (it needs to have built quarkus master locally)

**Environment (please complete the following information):**
 - Quarkus version or git rev: 999-SNAPSHOT


Changed files:
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcConfigurationMetadata.java
integration-tests/oidc/src/test/java/io/quarkus/it/keycloak/BearerTokenAuthorizationTest.java
integration-tests/oidc-tenancy/src/main/java/io/quarkus/it/keycloak/OidcResource.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java
extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
integration-tests/oidc-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakTestResource.java

diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcConfigurationMetadata.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcConfigurationMetadata.java
index e77d507217a..00c6aa56c18 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcConfigurationMetadata.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/OidcConfigurationMetadata.java
@@ -3,6 +3,14 @@
 import io.vertx.core.json.JsonObject;
 
 public class OidcConfigurationMetadata {
+    private static final String ISSUER = "issuer";
+    private static final String TOKEN_ENDPOINT = "token_endpoint";
+    private static final String INTROSPECTION_ENDPOINT = "introspection_endpoint";
+    private static final String AUTHORIZATION_ENDPOINT = "authorization_endpoint";
+    private static final String JWKS_ENDPOINT = "jwks_uri";
+    private static final String USERINFO_ENDPOINT = "userinfo_endpoint";
+    private static final String END_SESSION_ENDPOINT = "end_session_endpoint";
+
     private final String tokenUri;
     private final String introspectionUri;
     private final String authorizationUri;
@@ -28,13 +36,13 @@ public OidcConfigurationMetadata(String tokenUri,
     }
 
     public OidcConfigurationMetadata(JsonObject wellKnownConfig) {
-        this.tokenUri = wellKnownConfig.getString("token_endpoint");
-        this.introspectionUri = wellKnownConfig.getString("token_introspection_endpoint");
-        this.authorizationUri = wellKnownConfig.getString("authorization_endpoint");
-        this.jsonWebKeySetUri = wellKnownConfig.getString("jwks_uri");
-        this.userInfoUri = wellKnownConfig.getString("userinfo_endpoint");
-        this.endSessionUri = wellKnownConfig.getString("end_session_endpoint");
-        this.issuer = wellKnownConfig.getString("issuer");
+        this.tokenUri = wellKnownConfig.getString(TOKEN_ENDPOINT);
+        this.introspectionUri = wellKnownConfig.getString(INTROSPECTION_ENDPOINT);
+        this.authorizationUri = wellKnownConfig.getString(AUTHORIZATION_ENDPOINT);
+        this.jsonWebKeySetUri = wellKnownConfig.getString(JWKS_ENDPOINT);
+        this.userInfoUri = wellKnownConfig.getString(USERINFO_ENDPOINT);
+        this.endSessionUri = wellKnownConfig.getString(END_SESSION_ENDPOINT);
+        this.issuer = wellKnownConfig.getString(ISSUER);
     }
 
     public String getTokenUri() {
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java
index ed943b65899..038ff30a244 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcIdentityProvider.java
@@ -141,10 +141,10 @@ public Uni<SecurityIdentity> apply(TokenVerificationResult result, Throwable t)
                             tokenJson = OidcUtils.decodeJwtContent(tokenCred.getToken());
                         }
                         if (tokenJson != null) {
-                            OidcUtils.validatePrimaryJwtTokenType(resolvedContext.oidcConfig.token, tokenJson);
-                            JsonObject rolesJson = getRolesJson(vertxContext, resolvedContext, tokenCred, tokenJson,
-                                    userInfo);
                             try {
+                                OidcUtils.validatePrimaryJwtTokenType(resolvedContext.oidcConfig.token, tokenJson);
+                                JsonObject rolesJson = getRolesJson(vertxContext, resolvedContext, tokenCred, tokenJson,
+                                        userInfo);
                                 SecurityIdentity securityIdentity = validateAndCreateIdentity(vertxContext, tokenCred,
                                         resolvedContext.oidcConfig,
                                         tokenJson, rolesJson, userInfo);
@@ -154,7 +154,7 @@ public Uni<SecurityIdentity> apply(TokenVerificationResult result, Throwable t)
                                     return Uni.createFrom().item(securityIdentity);
                                 }
                             } catch (Throwable ex) {
-                                return Uni.createFrom().failure(ex);
+                                return Uni.createFrom().failure(new AuthenticationFailedException(ex));
                             }
                         } else if (tokenCred instanceof IdTokenCredential
                                 || tokenCred instanceof AccessTokenCredential
diff --git a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
index 2c1d2c69ea9..e6bb891ba32 100644
--- a/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
+++ b/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/OidcRecorder.java
@@ -160,10 +160,6 @@ private Uni<TenantConfigContext> createTenantContext(Vertx vertx, OidcTenantConf
             }
         }
 
-        final long connectionRetryCount = OidcCommonUtils.getConnectionRetryCount(oidcConfig);
-        if (connectionRetryCount > 1) {
-            LOG.infof("Connecting to IDP for up to %d times every 2 seconds", connectionRetryCount);
-        }
         return createOidcProvider(oidcConfig, tlsConfig, vertx)
                 .onItem().transform(p -> new TenantConfigContext(p, oidcConfig));
     }
diff --git a/integration-tests/oidc-tenancy/src/main/java/io/quarkus/it/keycloak/OidcResource.java b/integration-tests/oidc-tenancy/src/main/java/io/quarkus/it/keycloak/OidcResource.java
index 9bd0f16d2a0..0d4b3e0b263 100644
--- a/integration-tests/oidc-tenancy/src/main/java/io/quarkus/it/keycloak/OidcResource.java
+++ b/integration-tests/oidc-tenancy/src/main/java/io/quarkus/it/keycloak/OidcResource.java
@@ -41,7 +41,7 @@ public String discovery() {
         final String baseUri = ui.getBaseUriBuilder().path("oidc").build().toString();
         return "{" +
                 "   \\"token_endpoint\\":" + "\\"" + baseUri + "/token\\"," +
-                "   \\"token_introspection_endpoint\\":" + "\\"" + baseUri + "/introspect\\"," +
+                "   \\"introspection_endpoint\\":" + "\\"" + baseUri + "/introspect\\"," +
                 "   \\"jwks_uri\\":" + "\\"" + baseUri + "/jwks\\"" +
                 "  }";
     }
diff --git a/integration-tests/oidc-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakTestResource.java b/integration-tests/oidc-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakTestResource.java
index 405bcfdceba..a1eda7a792c 100644
--- a/integration-tests/oidc-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakTestResource.java
+++ b/integration-tests/oidc-wiremock/src/test/java/io/quarkus/it/keycloak/KeycloakTestResource.java
@@ -41,7 +41,7 @@ public Map<String, String> start() {
                                 .withBody("{\\n" +
                                         "    \\"jwks_uri\\": \\"" + server.baseUrl()
                                         + "/auth/realms/quarkus/protocol/openid-connect/certs\\",\\n" +
-                                        "    \\"token_introspection_endpoint\\": \\"" + server.baseUrl()
+                                        "    \\"introspection_endpoint\\": \\"" + server.baseUrl()
                                         + "/auth/realms/quarkus/protocol/openid-connect/token/introspect\\",\\n"
                                         + "\\"issuer\\" : \\"https://server.example.com\\""
                                         + "}")));
diff --git a/integration-tests/oidc/src/test/java/io/quarkus/it/keycloak/BearerTokenAuthorizationTest.java b/integration-tests/oidc/src/test/java/io/quarkus/it/keycloak/BearerTokenAuthorizationTest.java
index a6e266bddf5..b5a88e6f758 100644
--- a/integration-tests/oidc/src/test/java/io/quarkus/it/keycloak/BearerTokenAuthorizationTest.java
+++ b/integration-tests/oidc/src/test/java/io/quarkus/it/keycloak/BearerTokenAuthorizationTest.java
@@ -133,13 +133,21 @@ public void testDeniedAccessAdminResource() {
     }
 
     @Test
-    public void testDeniedNoBearerToken() {
+    public void testVerificationFailedNoBearerToken() {
         RestAssured.given()
                 .when().get("/api/users/me").then()
                 .statusCode(401);
     }
 
+    @Test
+    public void testVerificationFailedInvalidToken() {
+        RestAssured.given().auth().oauth2("123")
+                .when().get("/api/users/me").then()
+                .statusCode(401);
+    }
+
     //see https://github.com/quarkusio/quarkus/issues/5809
+    @Test
     @RepeatedTest(20)
     public void testOidcAndVertxHandler() {
         RestAssured.given().auth().oauth2(getAccessToken("alice"))