quarkusio/quarkus · error · IllegalArgumentException

Build step '%s' does not produce any build item and thus wil

Error message

Build step '%s' does not produce any build item and thus will never get executed. Either change the return type of the method to a build item type, add a parameter of type BuildProducer<[some build item type]>/Consumer<[some build item type]>, or annotate the method with @Produces. Use @Produce(ArtifactResultBuildItem.class) if you want to always execute this step.

What it means

OpenApiServlet's doGet asserts that an authenticated principal exists for requests to /openapi/*. If Elytron authentication did not populate the security context, getUserPrincipal() is null and the subsequent .getName() call throws, producing this error. It means the OpenAPI path was served without an authenticated identity.

Source

Thrown at core/builder/src/main/java/io/quarkus/builder/BuildStepBuilder.java:185

     * @param flags a set of flags which modify the consume operation (must not be {@code null})
     * @return this builder
     */
    public BuildStepBuilder consumes(Class<? extends BuildItem> type, ConsumeFlags flags) {
        Assert.checkNotNullParam("type", type);
        checkType(type);
        addConsumes(new ItemId(type), Constraint.REAL, flags);
        return this;
    }

    /**
     * Build this step into the chain.
     *
     * @return the chain builder that this step was added to
     */
    public BuildChainBuilder build() {
        final BuildChainBuilder chainBuilder = this.buildChainBuilder;
        if (produces.isEmpty()) {
            throw new IllegalArgumentException(
                    "Build step '" + buildStep.getId()
                            + "' does not produce any build item and thus will never get executed."
                            + " Either change the return type of the method to a build item type,"
                            + " add a parameter of type BuildProducer<[some build item type]>/Consumer<[some build item type]>,"
                            + " or annotate the method with @Produces."
                            + " Use @Produce(ArtifactResultBuildItem.class) if you want to always execute this step.");
        }
        if (BuildChainBuilder.LOG_CONFLICT_CAUSING) {
            chainBuilder.addStep(this, new Exception().getStackTrace());
        } else {
            chainBuilder.addStep(this, EMPTY_STACK_TRACE);
        }
        return chainBuilder;
    }

    /**
     * Build this step into the chain if the supplier returns {@code true}.
     *

View on GitHub (pinned to e1c734241f)

Solutions

  1. Provide valid credentials on the /openapi/* request.
  2. Configure quarkus.http.auth.permission.* to require authentication on /openapi/* and verify the elytron realm maps the user.
  3. Check the servlet's urlPatterns and security constraints (@ServletSecurity) force authentication.
  4. Null-check getUserPrincipal() before getName().

Example fix

// before
if (req.getUserPrincipal().getName() == null) {
    throw new RuntimeException("principal was null");
}
// after
if (req.getUserPrincipal() == null) {
    throw new RuntimeException("principal was null");
}
Defensive patterns

Strategy: validation

Validate before calling

if (!"name".equalsIgnoreCase(type)) {
    throw new IllegalArgumentException("Only type=name is supported by fruitsFindBy");
}

Try / catch

try {
    given().get("/fruitsFindBy?type=" + type + "&value=" + value);
} catch (Exception e) {
    // fall back to type=name or fix the query parameter
}

Prevention

When it happens

Trigger: GET to /openapi/* with no/wrong credentials, or security policy allowing anonymous access, so req.getUserPrincipal() is null and .getName() throws.

Common situations: Hitting the endpoint without Authorization header; exposing /openapi/* anonymously in quarkus.http.auth.permission config while the test expects auth; elytron identity provider not registering; incorrect URL pattern causing the wrong servlet to run.

Related errors


AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e6ea6442e75b27d0. Report an issue: GitHub.