{"record":{"id":"9bc6c38f012928d7","repo":"quarkusio/quarkus","slug":"the-s-annotation-is-only-supported-when-proacti","errorCode":null,"errorMessage":"The '%s' annotation is only supported when proactive authentication is disabled","messagePattern":"The '(.+?)' annotation is only supported when proactive authentication is disabled","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java","lineNumber":548,"sourceCode":"            additionalBeanProducer.produce(AdditionalBeanBuildItem.unremovableOf(WebSocketIdentityUpdateProvider.class));\n        }\n    }\n\n    @Record(ExecutionTime.STATIC_INIT)\n    @BuildStep\n    FilterBuildItem registerResourceMetadataHandler(OidcBuildTimeConfig buildTimeConfig,\n            BeanContainerBuildItem beanContainerBuildItem, OidcRecorder recorder) {\n        if (!isRouteAllowed(buildTimeConfig, OidcRoute.RESOURCE_METADATA)) {\n            return null;\n        }\n        Handler<RoutingContext> handler = recorder.getResourceMetadataHandler(beanContainerBuildItem.getValue());\n        return new FilterBuildItem(handler, SecurityHandlerPriorities.AUTHORIZATION - 50);\n    }\n\n    private static boolean areEagerSecInterceptorsSupported(Capabilities capabilities,\n            VertxHttpBuildTimeConfig httpBuildTimeConfig) {\n        if (httpBuildTimeConfig.auth().proactive()) {\n            throw new RuntimeException(\"The '%s' annotation is only supported when proactive authentication is disabled\"\n                    .formatted(AUTHENTICATION_CONTEXT_NAME));\n        } else if (capabilities.isMissing(Capability.WEBSOCKETS_NEXT) && capabilities.isMissing(Capability.RESTEASY_REACTIVE)\n                && capabilities.isMissing(Capability.RESTEASY)) {\n            throw new RuntimeException(\"The '%s' can only be used on Jakarta REST or WebSockets Next endpoints\");\n        }\n        return true;\n    }\n\n    private static boolean isInjected(BeanRegistrationPhaseBuildItem beanRegistrationPhaseBuildItem, DotName requiredType,\n            DotName withoutQualifier) {\n        for (InjectionPointInfo injectionPoint : beanRegistrationPhaseBuildItem.getInjectionPoints()) {\n            if (requiredType.equals(injectionPoint.getRequiredType().name())\n                    && isApplicationPackage(injectionPoint.getTargetInfo())\n                    && (withoutQualifier == null || injectionPoint.getRequiredQualifier(withoutQualifier) == null)) {\n                LOG.debugf(\"%s injection point: %s\", requiredType.toString(), injectionPoint.getTargetInfo());\n                return true;\n            }\n        }","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java#L530-L566","documentation":"The @AuthenticationContext (and similar eager security) interceptor only works when proactive authentication is disabled, because it must run at request-time per endpoint. areEagerSecInterceptorsSupported() checks the Vert.x HTTP build-time config and throws RuntimeException if quarkus.http.auth.proactive is true (the default in some versions).","triggerScenarios":"Using @AuthenticationContext on an endpoint while quarkus.http.auth.proactive=true (explicitly set or left at default) — detected during build-step registration.","commonSituations":"Newer apps relying on default proactive auth that adopt the annotation; upgrading and enabling proactive auth globally while still using per-endpoint acr/max-age annotations.","solutions":["Set quarkus.http.auth.proactive=false in application.properties","Remove the @AuthenticationContext annotation if proactive auth must stay enabled","Set the acr/max-age requirement globally in OIDC tenant config instead of per-endpoint"],"exampleFix":"// before\nquarkus.http.auth.proactive=true\n// after\nquarkus.http.auth.proactive=false","handlingStrategy":"validation","validationCode":"// application.properties check before using @AuthenticationContext\n// quarkus.http.auth.proactive must be false\nif (Boolean.parseBoolean(System.getProperty(\"quarkus.http.auth.proactive\", \"true\"))) {\n    throw new IllegalStateException(\"Disable proactive auth to use @AuthenticationContext\");\n}","typeGuard":null,"tryCatchPattern":"try { Quarkus.run(args); } catch (RuntimeException e) { if (e.getMessage().contains(\"only supported when proactive authentication is disabled\")) { /* set quarkus.http.auth.proactive=false */ } }","preventionTips":["Set quarkus.http.auth.proactive=false when using per-endpoint auth annotations","Keep proactive-auth setting and annotation usage consistent","Verify with a build after config changes"],"tags":["oidc","config","authentication","build-time"],"backgroundTag":"proactive-auth-conflict","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}