quarkusio/quarkus · error · ConfigurationException

Annotation '%s' placed on '%s' specifies no 'acr' value

Error message

Annotation '%s' placed on '%s' specifies no 'acr' value

What it means

When registering the OIDC authentication context (@AuthenticationContext) interceptor, the build step reads the annotation's acr value. If the annotation is present but declares no acr values (empty array or null), a ConfigurationException is thrown because the resulting acr-to-max-age mapping would be meaningless.

Source

Thrown at extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java:474

            BuildProducer<EagerSecurityInterceptorBindingBuildItem> bindingProducer,
            Optional<SecurityTransformerBuildItem> securityTransformerBuildItem) {
        var authCtxAnnotations = combinedIndexBuildItem.getIndex().getAnnotations(AUTHENTICATION_CONTEXT_NAME);
        if (authCtxAnnotations.isEmpty() || !areEagerSecInterceptorsSupported(capabilities, httpBuildTimeConfig)) {
            return;
        }
        SecurityTransformer securityTransformer = SecurityTransformerBuildItem.createSecurityTransformer(
                combinedIndexBuildItem.getIndex(), securityTransformerBuildItem);
        bindingProducer.produce(new EagerSecurityInterceptorBindingBuildItem(recorder.authenticationContextInterceptorCreator(),
                ai -> {
                    AnnotationValue maxAgeAnnotationValue = ai.value("maxAge");
                    String maxAge = maxAgeAnnotationValue == null ? "" : maxAgeAnnotationValue.asString();

                    String acrValues = "";
                    AnnotationValue annotationValue = ai.value();
                    String[] annotationValues = annotationValue == null ? null : annotationValue.asStringArray();
                    if (annotationValues == null || annotationValues.length == 0) {
                        // no acr values and no max age
                        throw new ConfigurationException("Annotation '" + AUTHENTICATION_CONTEXT_NAME + "' placed on '"
                                + toTargetName(ai.target()) + "' specifies no 'acr' value");
                    } else {
                        acrValues = String.join(",", annotationValues);
                    }

                    return acrValues + ACR_VALUES_TO_MAX_AGE_SEPARATOR + maxAge;
                }, true, AUTHENTICATION_CONTEXT_NAME));

        // @AuthenticationContext -> authentication required
        // register @Authenticated for annotated methods
        Set<MethodInfo> annotatedMethods = collectMethodsWithoutRbacAnnotation(authCtxAnnotations
                .stream()
                .map(AnnotationInstance::target)
                .filter(at -> at.kind() == METHOD)
                .map(AnnotationTarget::asMethod)
                .toList(), securityTransformer);
        additionalSecuredMethodsProducer
                .produce(new AdditionalSecuredMethodsBuildItem(annotatedMethods, Optional.of(List.of("**"))));

View on GitHub (pinned to e1c734241f)

Solutions

1. Add at least one acr value to @AuthenticationContext, e.g. @AuthenticationContext(acr = "acf")
2. Remove the annotation entirely if no acr-based step-up is intended
3. Ensure the annotation attribute name used matches 'acr' (an array of strings)

Example fix

// before
@AuthenticationContext
@Path("/admin")
Response admin();
// after
@AuthenticationContext(acr = { "acf" })
@Path("/admin")
Response admin();

AuthenticationContext ctx = ...; // reflectively or at authoring time
if (ctx != null && (ctx.acr() == null || ctx.acr().length == 0)) throw new IllegalStateException("@AuthenticationContext requires at least one acr value");

try { build(); } catch (ConfigurationException e) { if (e.getMessage().contains("specifies no 'acr' value")) { /* fix annotation */ } }

When it happens

Trigger: Placing @AuthenticationContext on a Jakarta REST endpoint or method without any acr attribute values (empty @AuthenticationContext or @AuthenticationContext({})), combined with a maxAge setting.

Common situations: Adding the annotation for step-up authentication but forgetting the acr values; IDE auto-completing an empty annotation; refactoring away the values while keeping the annotation.

Related errors

• The '%s' annotation is only supported when proactive authent
• The '%s' can only be used on Jakarta REST or WebSockets Next
• The configuration ${clazz} must be an interface annotated wi
• The configuration ${clazz} is missing the @ConfigRoot annota
• Annotation instance ${annotationInstance} does not match ann

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e6a304605b9f630d. Report an issue: GitHub.