{"record":{"id":"921a0688c21a5c7b","repo":"quarkusio/quarkus","slug":"found-unknown-security-annotation-s","errorCode":null,"errorMessage":"Found unknown security annotation: %s","messagePattern":"Found unknown security annotation: (.+?)","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java","lineNumber":1184,"sourceCode":"                    .sorted(Comparator.comparing(item -> item.getClassName().toString())).forEach(item -> {\n                        var securityAnnotationName = item.getSecurityAnnotationInstance().name();\n\n                        final SecurityCheck securityCheck;\n                        if (DENY_ALL.equals(securityAnnotationName)) {\n                            securityCheck = recorder.denyAll();\n                        } else if (PERMIT_ALL.equals(securityAnnotationName)) {\n                            securityCheck = recorder.permitAll();\n                        } else if (AUTHENTICATED.equals(securityAnnotationName)) {\n                            securityCheck = recorder.authenticated();\n                        } else if (ROLES_ALLOWED.equals(securityAnnotationName)) {\n                            var allowedRoles = item.getSecurityAnnotationInstance().value().asStringArray();\n                            securityCheck = computeRolesAllowedCheck(cache, hasRolesAllowedCheckWithConfigExp, keyIndex,\n                                    recorder,\n                                    allowedRoles);\n                        } else if (PERMISSIONS_ALLOWED.equals(securityAnnotationName)) {\n                            securityCheck = Objects.requireNonNull(classNameToPermCheck.get(item.getClassName()));\n                        } else {\n                            throw new IllegalStateException(\"Found unknown security annotation: \" + securityAnnotationName);\n                        }\n\n                        classStorageBuilder.addSecurityCheck(item.getClassName(), securityCheck);\n                    });\n            classSecurityCheckStorageProducer.produce(classStorageBuilder.build());\n        }\n\n        final boolean registerRolesAllowedConfigSource;\n        // way to resolve roles allowed configuration expressions specified via annotations to configuration values\n        if (!rolesAllowedConfigExpResolverBuildItems.isEmpty()) {\n            registerRolesAllowedConfigSource = true;\n            for (RolesAllowedConfigExpResolverBuildItem item : rolesAllowedConfigExpResolverBuildItems) {\n                recorder.recordRolesAllowedConfigExpression(item.getRoleConfigExpr(), keyIndex.getAndIncrement(),\n                        item.getConfigValueRecorder());\n            }\n        } else {\n            registerRolesAllowedConfigSource = hasRolesAllowedCheckWithConfigExp.get();\n        }","sourceCodeStart":1166,"sourceCodeEnd":1202,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java#L1166-L1202","documentation":"SecurityProcessor dispatches on the name of the security annotation found on a method/class (RolesAllowed, PermissionsAllowed, DenyAll, Authenticated, PermissionsAllowed etc.). If an annotation in the security annotation index is not one of the recognized names, the build aborts. This usually indicates a custom or unrecognized annotation that Quarkus's annotation scanner associated with security handling.","triggerScenarios":"A method or class carries a security annotation name that reaches gatherSecurityAnnotations but is not one of the handled constants (@RolesAllowed, @PermissionsAllowed, @DenyAll, @Authenticated, ...), typically from a custom meta-annotated annotation or a mismatched extension version.","commonSituations":"Using a third-party extension that adds its own security annotation without a corresponding build step; mixing Quarkus versions where security-annotations SPI changed; copying @CustomSecurity meta-annotation from a tutorial that required extra wiring.","solutions":["Identify the annotation class from the error message and either replace it with a standard Quarkus annotation (@RolesAllowed, @PermissionsAllowed, @Authenticated, @DenyAll).","If it is a custom annotation, add the required build step / meta-annotation mapping (or annotate it with the Quarkus security annotation it should delegate to).","Align versions of all security-related extensions so their annotation processors match the core annotation set."],"exampleFix":"// before\n@MyCustomSecure\npublic String data() { ... }\n// after\n@RolesAllowed(\"admin\")\npublic String data() { ... }","handlingStrategy":"validation","validationCode":"Set<String> allowed = Set.of(\"jakarta.annotation.security.RolesAllowed\",\"io.quarkus.security.PermissionsAllowed\",\"jakarta.annotation.security.DenyAll\",\"jakarta.annotation.security.PermitAll\",\"io.quarkus.security.Authenticated\");\n// fail fast if a security-looking annotation is not recognized\nif (!allowed.contains(annotationName)) throw new IllegalStateException(\"unrecognized: \" + annotationName);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Stick to standard Quarkus security annotations","Meta-annotate custom annotations with a supported Quarkus one","Keep extension versions aligned with core"],"tags":["quarkus","security","build-time","annotation-processing"],"backgroundTag":"unknown-security-annotation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}