{"record":{"id":"88c29dd10bf42bcb","repo":"quarkusio/quarkus","slug":"quarkus-http-auth-certificate-role-properties-loca","errorCode":null,"errorMessage":"quarkus.http.auth.certificate-role-properties location can not be resolved","messagePattern":"quarkus\\.http\\.auth\\.certificate-role-properties location can not be resolved","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityRecorder.java","lineNumber":495,"sourceCode":"                if (mTLS.isCertificateToRolesMapperSet()) {\n                    throw new ConfigurationException(\"The 'quarkus.http.auth.certificate-role-properties' configuration\"\n                            + \" property is set, but the certificate to roles mapping has been configured \"\n                            + \"programmatically with the '%s' API\".formatted(MTLS.class.getName()),\n                            Set.of(\"quarkus.http.auth.certificate-role-properties\"));\n                }\n                Path rolesPath = httpConfig.auth().certificateRoleProperties().get();\n                URL rolesResource = null;\n                if (Files.exists(rolesPath)) {\n                    try {\n                        rolesResource = rolesPath.toUri().toURL();\n                    } catch (MalformedURLException e) {\n                        // The Files.exists(rolesPath) check has succeeded therefore this exception can't happen in this case\n                    }\n                } else {\n                    rolesResource = Thread.currentThread().getContextClassLoader().getResource(rolesPath.toString());\n                }\n                if (rolesResource == null) {\n                    throw new ConfigurationException(\n                            \"quarkus.http.auth.certificate-role-properties location can not be resolved\",\n                            Set.of(\"quarkus.http.auth.certificate-role-properties\"));\n                }\n\n                try (Reader reader = new BufferedReader(\n                        new InputStreamReader(rolesResource.openStream(), StandardCharsets.UTF_8))) {\n                    Properties rolesProps = new Properties();\n                    rolesProps.load(reader);\n\n                    Map<String, Set<String>> roles = new HashMap<>();\n                    for (Map.Entry<Object, Object> e : rolesProps.entrySet()) {\n                        log.debugf(\"Added role mapping for %s:%s\", e.getKey(), e.getValue());\n                        roles.put((String) e.getKey(), parseRoles((String) e.getValue()));\n                    }\n\n                    if (!roles.isEmpty()) {\n                        var certRolesAttribute = new CertificateRoleAttribute(httpConfig.auth().certificateRoleAttribute(),\n                                roles);","sourceCodeStart":477,"sourceCodeEnd":513,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityRecorder.java#L477-L513","documentation":"Thrown by HttpSecurityRecorder.setMtlsCertificateRoleProperties as a ConfigurationException when the location given by 'quarkus.http.auth.certificate-role-properties' cannot be resolved: it is neither an existing filesystem path nor a classpath resource reachable via the context class loader. The rolesResource ends up null and startup fails.","triggerScenarios":"Setting quarkus.http.auth.certificate-role-properties to a file path that does not exist on disk and is not on the classpath, e.g. a path valid only on the developer machine, a file excluded from the native image, or a typo'd resource name.","commonSituations":"Native-image builds where the properties file was not included as a resource; container images missing the mounted file; relative paths resolved against the wrong working directory; resources placed outside src/main/resources.","solutions":["Put the properties file in src/main/resources so it ships on the classpath and reference it by resource name.","Fix the configured path (absolute path, correct mount in the container) so Files.exists() succeeds.","For native builds, ensure the file is included as a resource (quarkus.native.resources.includes) rather than relying on filesystem paths."],"exampleFix":"// before\n// quarkus.http.auth.certificate-role-properties=/local/cert-roles.properties  (not in image)\n// after: move file to src/main/resources/cert-roles.properties\n// quarkus.http.auth.certificate-role-properties=cert-roles.properties","handlingStrategy":"validation","validationCode":"String loc = config.getValue(\"quarkus.http.auth.certificate-role-properties\");\nif (loc != null && !Files.exists(Path.of(loc)) && Thread.currentThread().getContextClassLoader().getResource(loc) == null) {\n    throw new IllegalStateException(\"certificate-role-properties location not resolvable: \" + loc);\n}","typeGuard":null,"tryCatchPattern":"try { /* build */ } catch (ConfigurationException e) { if (!e.getMessage().contains(\"location can not be resolved\")) throw e; /* fix or remove the property */ }","preventionTips":["Package the properties file in src/main/resources and reference it by classpath name.","For native builds, include the file via quarkus.native.resources.includes.","Verify the file exists inside the deployed container image, not just locally."],"tags":["quarkus","mtls","configuration","resource-not-found","static-init"],"backgroundTag":"resource-not-found","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}