{"record":{"id":"867c932836b27412","repo":"quarkusio/quarkus","slug":"client-authentication-cannot-be-disabled-with-this-867c93","errorCode":null,"errorMessage":"Client authentication cannot be disabled with this API","messagePattern":"Client authentication cannot be disabled with this API","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/MTLS.java","lineNumber":198,"sourceCode":"            this.tlsConfiguration = tlsConfiguration;\n            return this;\n        }\n\n        /**\n         * When the mutual TLS client authentication is configured with this builder, the client authentication\n         * is {@link ClientAuth#REQUIRED} for all requests by default. If you configure {@link ClientAuth#REQUEST},\n         * the client authentication is accepted if presented by a client.\n         * Use the {@link ClientAuth#REQUEST} option if the client authentication is only required for certain routes\n         * and secure these routes with HTTP permissions or standard security annotations.\n         *\n         * @param clientAuthentication {@link ClientAuth#REQUEST} or {@link ClientAuth#REQUIRED}\n         * @return Builder\n         * @see VertxHttpBuildTimeConfig#tlsClientAuth() for more information\n         */\n        public Builder authentication(ClientAuth clientAuthentication) {\n            Objects.requireNonNull(clientAuthentication);\n            if (clientAuthentication == ClientAuth.NONE) {\n                throw new IllegalArgumentException(\"Client authentication cannot be disabled with this API\");\n            }\n            this.clientAuth = clientAuthentication;\n            return this;\n        }\n\n        /**\n         * Selects a certificate attribute which values are mapped to the {@link SecurityIdentity} roles.\n         * This attribute will be used for mappings added with the {@link #rolesMapping(String, Set)} method.\n         * The default attribute value is configured to the default\n         * value of the {@link AuthRuntimeConfig#certificateRoleAttribute()} configuration property.\n         *\n         * @param certificateAttribute certificate attribute; see {@link AuthRuntimeConfig#certificateRoleAttribute()}\n         *        for information about supported values\n         * @return CertificateRolesBuilder\n         */\n        public Builder certificateAttribute(String certificateAttribute) {\n            assertCertificateToRolesMapperNotSetYet();\n            this.certificateAttribute = Objects.requireNonNull(certificateAttribute);","sourceCodeStart":180,"sourceCodeEnd":216,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/MTLS.java#L180-L216","documentation":"MTLS.Builder.authentication(ClientAuth) throws IllegalArgumentException when called with ClientAuth.NONE, because this API exists to ENABLE mTLS client authentication; disabling it is not supported here (client auth is controlled by build-time config tlsClientAuth).","triggerScenarios":"Calling mtlsBuilder.authentication(ClientAuth.NONE), often from a config-driven switch mapping a disabled/none value to the enum.","commonSituations":"Config value \"none\" passed straight through to the builder; attempting to toggle mTLS off at runtime; generic enum-mapping code ignoring the API restriction.","solutions":["Do not call authentication() when client auth should be NONE — omit the call entirely","Map the disabled case to skipping the mTLS builder setup","Control enable/disable via VertxHttpBuildTimeConfig.tlsClientAuth config instead"],"exampleFix":"// before\nbuilder.authentication(clientAuthFromConfig); // may be NONE\n// after\nif (clientAuthFromConfig != ClientAuth.NONE) {\n    builder.authentication(clientAuthFromConfig);\n}","handlingStrategy":"validation","validationCode":"if (clientAuth != null && clientAuth != ClientAuth.NONE) {\n    builder.authentication(clientAuth);\n}","typeGuard":"boolean isEnableableClientAuth(ClientAuth a) { return a != null && a != ClientAuth.NONE; }","tryCatchPattern":null,"preventionTips":["Never map a 'disabled' config value to ClientAuth.NONE in this API","Skip authentication() entirely to leave client auth off","Control enable/disable via tlsClientAuth build-time config"],"tags":["quarkus","mtls","illegal-argument","client-auth","tls"],"backgroundTag":"invalid-argument-value","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}