quarkusio/quarkus · error · IllegalArgumentException

Authentication mechanism must not be null or emptz

Error message

Authentication mechanism must not be null or emptz

What it means

Thrown by HttpPermission.authenticatedWith(Set<String>) when the schemes set is null or empty. At least one authentication scheme must be supplied; an empty set yields no usable mechanism, so the builder throws IllegalArgumentException. (Note the message's typo 'emptz' in this Quarkus version.)

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:465

        }

        @Override
        public HttpPermission authenticatedWith(String mechanism) {
            validateAuthenticationNotSetYet();
            requireAuthenticationByDefault();
            if (mechanism == null || mechanism.isBlank()) {
                throw new IllegalArgumentException("Authentication mechanism must not be null or blank");
            }
            this.authMechanism = new HttpSecurityConfiguration.AuthenticationMechanisms(mechanism);
            return this;
        }

        @Override
        public HttpPermission authenticatedWith(Set<String> schemes) {
            validateAuthenticationNotSetYet();
            requireAuthenticationByDefault();
            if (schemes == null || schemes.isEmpty()) {
                throw new IllegalArgumentException("Authentication mechanism must not be null or emptz");
            }
            this.authMechanism = HttpSecurityConfiguration.AuthenticationMechanisms.from(schemes);
            return this;
        }

        @Override
        public HttpPermission shared() {
            this.shared = true;
            return this;
        }

        @Override
        public HttpPermission applyToJaxRs() {
            this.applyToJaxRs = true;
            return this;
        }

        @Override

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-empty set of scheme names, e.g. Set.of("basic", "Bearer").
2. Check !schemes.isEmpty() before calling, and fall back to authenticated() or a default mechanism otherwise.
3. Fix the configuration source so the scheme list is populated.

Example fix

// before
Set<String> schemes = config.schemes(); // may be empty
httpSecurity.paths("/api/*").authenticatedWith(schemes); // throws
// after
if (schemes != null && !schemes.isEmpty()) {
    httpSecurity.paths("/api/*").authenticatedWith(schemes);
} else {
    httpSecurity.paths("/api/*").authenticated();
}

if (schemes == null || schemes.isEmpty()) throw new IllegalArgumentException("at least one scheme required");

static boolean hasSchemes(Set<String> s) { return s != null && !s.isEmpty(); }

try { perm.authenticatedWith(schemes); } catch (IllegalArgumentException e) { if (!e.getMessage().contains("must not be null or empt")) throw e; }

When it happens

Trigger: Calling authenticatedWith(Set.of()) or authenticatedWith(schemes) where schemes comes from an empty/missing config list or an unpopulated collection.

Common situations: Parsing allowed schemes from configuration that defaulted to an empty list; filtering a scheme set until it becomes empty; collecting scheme names at runtime with no matches.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Authentication has already been set
• Authentication mechanism must not be null or blank
• No IdentityProviders were registered to handle Authenticatio
• No AnonymousIdentityProvider registered. An instance of Anon
• AuthenticationFailedException

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9355999a0e64fa14. Report an issue: GitHub.