{"record":{"id":"d7fd288722cef0c5","repo":"quarkusio/quarkus","slug":"you-must-override-this-method-or-identityprovider","errorCode":null,"errorMessage":"You must override this method or IdentityProvider.authenticate","messagePattern":"You must override this method or IdentityProvider\\.authenticate","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/amazon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/LambdaIdentityProvider.java","lineNumber":40,"sourceCode":"    @Override\n    default Uni<SecurityIdentity> authenticate(LambdaAuthenticationRequest request, AuthenticationRequestContext context) {\n        APIGatewayV2HTTPEvent event = request.getEvent();\n        SecurityIdentity identity = authenticate(event);\n        if (identity == null) {\n            return Uni.createFrom().optional(Optional.empty());\n        }\n        return Uni.createFrom().item(identity);\n    }\n\n    /**\n     * You must override this method unless you directly override\n     * IdentityProvider.authenticate\n     *\n     * @param event\n     * @return\n     */\n    default SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) {\n        throw new IllegalStateException(\"You must override this method or IdentityProvider.authenticate\");\n    }\n}\n","sourceCodeStart":22,"sourceCodeEnd":43,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/amazon-lambda-http/runtime/src/main/java/io/quarkus/amazon/lambda/http/LambdaIdentityProvider.java#L22-L43","documentation":"In the lambda-http extension, LambdaIdentityProvider.authenticate(APIGatewayV2HTTPEvent) is a default method that must be overridden. The Quarkus SecurityIdentityProvider.authenticate implementation will delegate to this method; if not overridden it throws IllegalStateException, since there is no default authentication behavior.","triggerScenarios":"Registering a bean implementing LambdaIdentityProvider (lambda-http) but relying on the default authenticate(event) method without overriding it, and a request then attempts authentication.","commonSituations":"Implementing the interface without implementing authenticate; implementing the wrong method signature after a version change; expecting the interface to be optional when security is configured.","solutions":["Override SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) in your provider bean","If you do not need custom auth, remove the LambdaIdentityProvider bean or disable the auth mechanism","Extend a provided base implementation rather than implementing the interface raw","Match the exact method signature for the extension version you use"],"exampleFix":"// before\npublic class MyIdentityProvider implements LambdaIdentityProvider {}\n// after\npublic class MyIdentityProvider implements LambdaIdentityProvider {\n    @Override\n    public SecurityIdentity authenticate(APIGatewayV2HTTPEvent event) {\n        return SecurityIdentity.builder().build();\n    }\n}","handlingStrategy":"validation","validationCode":"// startup check\nLambdaIdentityProvider p = ...;\nif (p.getClass().getMethod(\"authenticate\", APIGatewayV2HTTPEvent.class)\n        .getDeclaringClass() == LambdaIdentityProvider.class) {\n    throw new IllegalStateException(\"Override authenticate(APIGatewayV2HTTPEvent)\");\n}","typeGuard":"boolean overridesAuthenticate(LambdaIdentityProvider p) {\n    try {\n        return p.getClass().getMethod(\"authenticate\", APIGatewayV2HTTPEvent.class)\n                .getDeclaringClass() != LambdaIdentityProvider.class;\n    } catch (NoSuchMethodException e) { return false; }\n}","tryCatchPattern":"try { identity = provider.authenticate(event); } catch (IllegalStateException e) { return anonymousIdentity(); }","preventionTips":["Always override authenticate(event) when implementing LambdaIdentityProvider","Don't share provider classes between lambda-http and lambda-rest extensions","Add a unit test that calls authenticate with a sample event"],"tags":["security","authentication","amazon-lambda-http"],"backgroundTag":"unimplemented-method","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}