{"record":{"id":"e6a304605b9f630d","repo":"quarkusio/quarkus","slug":"annotation-s-placed-on-s-specifies-no-acr","errorCode":null,"errorMessage":"Annotation '%s' placed on '%s' specifies no 'acr' value","messagePattern":"Annotation '(.+?)' placed on '(.+?)' specifies no 'acr' value","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java","lineNumber":474,"sourceCode":"            BuildProducer<EagerSecurityInterceptorBindingBuildItem> bindingProducer,\n            Optional<SecurityTransformerBuildItem> securityTransformerBuildItem) {\n        var authCtxAnnotations = combinedIndexBuildItem.getIndex().getAnnotations(AUTHENTICATION_CONTEXT_NAME);\n        if (authCtxAnnotations.isEmpty() || !areEagerSecInterceptorsSupported(capabilities, httpBuildTimeConfig)) {\n            return;\n        }\n        SecurityTransformer securityTransformer = SecurityTransformerBuildItem.createSecurityTransformer(\n                combinedIndexBuildItem.getIndex(), securityTransformerBuildItem);\n        bindingProducer.produce(new EagerSecurityInterceptorBindingBuildItem(recorder.authenticationContextInterceptorCreator(),\n                ai -> {\n                    AnnotationValue maxAgeAnnotationValue = ai.value(\"maxAge\");\n                    String maxAge = maxAgeAnnotationValue == null ? \"\" : maxAgeAnnotationValue.asString();\n\n                    String acrValues = \"\";\n                    AnnotationValue annotationValue = ai.value();\n                    String[] annotationValues = annotationValue == null ? null : annotationValue.asStringArray();\n                    if (annotationValues == null || annotationValues.length == 0) {\n                        // no acr values and no max age\n                        throw new ConfigurationException(\"Annotation '\" + AUTHENTICATION_CONTEXT_NAME + \"' placed on '\"\n                                + toTargetName(ai.target()) + \"' specifies no 'acr' value\");\n                    } else {\n                        acrValues = String.join(\",\", annotationValues);\n                    }\n\n                    return acrValues + ACR_VALUES_TO_MAX_AGE_SEPARATOR + maxAge;\n                }, true, AUTHENTICATION_CONTEXT_NAME));\n\n        // @AuthenticationContext -> authentication required\n        // register @Authenticated for annotated methods\n        Set<MethodInfo> annotatedMethods = collectMethodsWithoutRbacAnnotation(authCtxAnnotations\n                .stream()\n                .map(AnnotationInstance::target)\n                .filter(at -> at.kind() == METHOD)\n                .map(AnnotationTarget::asMethod)\n                .toList(), securityTransformer);\n        additionalSecuredMethodsProducer\n                .produce(new AdditionalSecuredMethodsBuildItem(annotatedMethods, Optional.of(List.of(\"**\"))));","sourceCodeStart":456,"sourceCodeEnd":492,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java#L456-L492","documentation":"When registering the OIDC authentication context (@AuthenticationContext) interceptor, the build step reads the annotation's acr value. If the annotation is present but declares no acr values (empty array or null), a ConfigurationException is thrown because the resulting acr-to-max-age mapping would be meaningless.","triggerScenarios":"Placing @AuthenticationContext on a Jakarta REST endpoint or method without any acr attribute values (empty @AuthenticationContext or @AuthenticationContext({})), combined with a maxAge setting.","commonSituations":"Adding the annotation for step-up authentication but forgetting the acr values; IDE auto-completing an empty annotation; refactoring away the values while keeping the annotation.","solutions":["Add at least one acr value to @AuthenticationContext, e.g. @AuthenticationContext(acr = \"acf\")","Remove the annotation entirely if no acr-based step-up is intended","Ensure the annotation attribute name used matches 'acr' (an array of strings)"],"exampleFix":"// before\n@AuthenticationContext\n@Path(\"/admin\")\nResponse admin();\n// after\n@AuthenticationContext(acr = { \"acf\" })\n@Path(\"/admin\")\nResponse admin();","handlingStrategy":"validation","validationCode":"AuthenticationContext ctx = ...; // reflectively or at authoring time\nif (ctx != null && (ctx.acr() == null || ctx.acr().length == 0)) throw new IllegalStateException(\"@AuthenticationContext requires at least one acr value\");","typeGuard":null,"tryCatchPattern":"try { build(); } catch (ConfigurationException e) { if (e.getMessage().contains(\"specifies no 'acr' value\")) { /* fix annotation */ } }","preventionTips":["Always provide acr values when using @AuthenticationContext","Remove the annotation if not needed","Code-review step-up auth annotations per endpoint"],"tags":["oidc","annotation","build-time","config"],"backgroundTag":"missing-annotation-attribute","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}