{"record":{"id":"a180d2a1171bc0da","repo":"quarkusio/quarkus","slug":"the-s-cdi-bean-injection-point-was-detected-bu","errorCode":null,"errorMessage":"The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.\nEither add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or\nimplement the provider yourself.\n","messagePattern":"The '(.+?)' CDI bean injection point was detected, but there is no '(.+?)' that supports '(.+?)'\\.\nEither add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or\nimplement the provider yourself\\.\n","errorType":"exception","errorClass":"WebSocketServerException","httpStatus":null,"severity":"error","filePath":"extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java","lineNumber":304,"sourceCode":"        };\n    }\n\n    public Function<SyntheticCreationalContext<WebSocketSecurity>, WebSocketSecurity> createWebSocketSecurity() {\n        final Supplier<Object> connectionSupplier = connectionSupplier();\n        return new Function<SyntheticCreationalContext<WebSocketSecurity>, WebSocketSecurity>() {\n            @Override\n            public WebSocketSecurity apply(SyntheticCreationalContext<WebSocketSecurity> ctx) {\n                Instance<IdentityProvider<?>> identityProviders = ctx.getInjectedReference(new TypeLiteral<>() {\n                });\n                boolean updateNotSupported = true;\n                for (IdentityProvider<?> identityProvider : identityProviders) {\n                    if (identityProvider.getRequestType() == WebSocketIdentityUpdateRequest.class) {\n                        updateNotSupported = false;\n                        break;\n                    }\n                }\n                if (updateNotSupported) {\n                    throw new WebSocketServerException(\"\"\"\n                            The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.\n                            Either add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or\n                            implement the provider yourself.\n                            \"\"\".formatted(WebSocketSecurity.class.getName(), IdentityProvider.class.getName(),\n                            WebSocketIdentityUpdateRequest.class.getName()));\n                }\n                final IdentityProviderManager identityProviderManager = ctx.getInjectedReference(IdentityProviderManager.class);\n                return new WebSocketSecurity() {\n                    @Override\n                    public CompletionStage<SecurityIdentity> updateSecurityIdentity(String accessToken) {\n                        if (connectionSupplier.get() instanceof WebSocketConnectionImpl connection) {\n                            SecuritySupport securitySupport = connection.securitySupport();\n                            return securitySupport.updateSecurityIdentity(accessToken, connection, identityProviderManager);\n                        }\n                        throw new WebSocketServerException(\n                                \"Only SecurityIdentity attached to a WebSocket server connection can be updated\");\n                    }\n                };","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java#L286-L322","documentation":"The application injects WebSocketSecurity (supporting SecurityIdentity updates) but no registered IdentityProvider supports WebSocketIdentityUpdateRequest. The recorder throws this WebSocketServerException at startup, telling you to add an extension (like Quarkus OIDC) or implement a provider that can perform the identity update.","triggerScenarios":"Injecting WebSocketSecurity and calling updateSecurityIdentity()/identity update flows while the only registered IdentityProviders handle other request types (e.g. only UsernamePasswordAuthenticationRequest) — so updateNotSupported stays true.","commonSituations":"Using WebSocketSecurity update APIs with quarkus-security but no OIDC/keycloak extension; switching auth mechanisms so the provider that handled WebSocketIdentityUpdateRequest disappeared; custom IdentityProvider not annotated/registered as a CDI bean.","solutions":["Add an extension that supports SecurityIdentity updates (e.g. quarkus-oidc)","Implement an IdentityProvider<WebSocketIdentityUpdateRequest> CDI bean yourself","Remove the WebSocketSecurity identity-update usage if updates are not needed"],"exampleFix":"// before\n@Inject WebSocketSecurity security; // no provider\n// after\n@ApplicationScoped\npublic class WsIdentityUpdateProvider implements IdentityProvider<WebSocketIdentityUpdateRequest> {\n    public Class<WebSocketIdentityUpdateRequest> getRequestType() { return WebSocketIdentityUpdateRequest.class; }\n    public Uni<SecurityIdentity> authenticate(WebSocketIdentityUpdateRequest request, AuthenticationRequestContext ctx) { ... }\n}","handlingStrategy":"validation","validationCode":"boolean supported = CDI.current().select(IdentityProvider.class)\n    .stream().anyMatch(p -> p.getRequestType() == WebSocketIdentityUpdateRequest.class);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Add quarkus-oidc (or implement IdentityProvider<WebSocketIdentityUpdateRequest>) whenever WebSocketSecurity updates are used","Only inject WebSocketSecurity when identity updates are actually needed","Document the provider dependency in the auth module"],"tags":["websockets","security","identity-provider","cdi","build-time"],"backgroundTag":"missing-identity-provider","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}