{"record":{"id":"e71543005618b1dd","repo":"quarkusio/quarkus","slug":"no-attributes-were-specified","errorCode":null,"errorMessage":"No attributes were specified","messagePattern":"No attributes were specified","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java","lineNumber":72,"sourceCode":"    @Authenticated\n    public String getSecure() {\n        return \"secure\";\n    }\n\n    @GET\n    @Path(\"/user\")\n    @RolesAllowed(\"user\")\n    public String user(@Context SecurityContext sec) {\n        return sec.getUserPrincipal().getName() + \":\" + identity.getPrincipal().getName() + \":\" + principal.getName();\n    }\n\n    @GET\n    @Path(\"/attributes\")\n    @Authenticated\n    public String getAttributes() {\n        final Map<String, Object> attributes = identity.getAttributes();\n        if (attributes == null || attributes.isEmpty()) {\n            throw new RuntimeException(\"No attributes were specified\");\n        }\n\n        return attributes.entrySet().stream()\n                .filter(e -> !HttpSecurityUtils.ROUTING_CONTEXT_ATTRIBUTE.equals(e.getKey()))\n                .map(e -> e.getKey() + \"=\" + e.getValue())\n                .collect(Collectors.joining(\",\"));\n    }\n\n    @GET\n    @Path(\"/test-security-permission-checker\")\n    @PermissionsAllowed(\"see-principal\")\n    public String getPrincipal(@Context SecurityContext sec) {\n        return sec.getUserPrincipal().getName() + \":\" + identity.getPrincipal().getName() + \":\" + principal.getName();\n    }\n\n    @PermissionChecker(\"see-principal\")\n    boolean canSeePrincipal(SecurityContext sec) {\n        if (sec.getUserPrincipal() == null || sec.getUserPrincipal().getName() == null) {","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java#L54-L90","documentation":"Sentinel RuntimeException thrown by RootResource.getAttributes(). It fires when SecurityIdentity.getAttributes() returns null or an empty map, i.e. the authenticated identity carries no attributes. Quarkus normally attaches at least the routing-context attribute, so an empty map means attribute providers did not contribute anything.","triggerScenarios":"GET /attributes with an @Authenticated identity whose attribute map is empty — attribute-supplying security providers absent or misconfigured.","commonSituations":"Custom SecurityIdentityAugmentor removed or not registered; Elytron realm configured without role/attribute mappings; extension version change altering default attributes.","solutions":["Register a SecurityIdentityAugmentor @ApplicationScoped bean that adds attributes to the identity","Verify Elytron realm configuration maps roles/attributes for the authenticated user","Check quarkus-elytron-security-* config for attribute-related settings","Confirm HttpSecurityUtils.ROUTING_CONTEXT_ATTRIBUTE is being attached by the HTTP security layer"],"exampleFix":"// before: no augmentor, identity has no attributes\n// after:\n@ApplicationScoped\npublic class AttrAugmentor implements SecurityIdentityAugmentor {\n    public Uni<SecurityIdentity> augment(SecurityIdentity identity, SecurityIdentityAugmentationContext ctx) {\n        return Uni.createFrom().item(build(identity));\n    }\n}","handlingStrategy":"validation","validationCode":"Map<String, Object> attrs = securityIdentity.getAttributes();\nif (attrs == null || attrs.isEmpty()) {\n    throw new IllegalStateException(\"Identity has no attributes; check SecurityIdentityAugmentor\");\n}","typeGuard":"boolean hasAttributes(SecurityIdentity identity) {\n    return identity != null && identity.getAttributes() != null && !identity.getAttributes().isEmpty();\n}","tryCatchPattern":"try {\n    return identity.getAttributes().entrySet();\n} catch (RuntimeException e) {\n    log.warn(\"No attributes on identity\", e);\n    return Set.of();\n}","preventionTips":["Register a SecurityIdentityAugmentor that guarantees at least one attribute","Test attribute presence in integration tests for every secured endpoint","Keep realm role/attribute mappings in version control with app config"],"tags":["security","elytron","identity-attributes"],"backgroundTag":"security-identity-no-attributes","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}