quarkusio/quarkus · error · RuntimeException

No attributes were specified

Error message

No attributes were specified

What it means

Sentinel RuntimeException thrown by RootResource.getAttributes() in the reactive test when SecurityIdentity.getAttributes() is null or empty. Reactive variant of error 3901: the @Authenticated identity exists but carries no attributes.

Source

Thrown at integration-tests/elytron-resteasy-reactive/src/main/java/io/quarkus/it/resteasy/reactive/elytron/RootResource.java:81

    @PermissionsAllowed(value = "manager-permission", permission = ManagerPermission.class)
    public String managerPermission(@Context SecurityContext sec) {
        return sec.getUserPrincipal().getName();
    }

    @GET
    @Path("/employee")
    @RolesAllowed("${employees-config-property}")
    public String employee(@Context SecurityContext sec) {
        return sec.getUserPrincipal().getName();
    }

    @GET
    @Path("/attributes")
    @Authenticated
    public String getAttributes() {
        final Map<String, Object> attributes = identity.getAttributes();
        if (attributes == null || attributes.isEmpty()) {
            throw new RuntimeException("No attributes were specified");
        }

        return attributes.entrySet().stream()
                .map(e -> e.getKey() + "=" + e.getValue())
                .collect(Collectors.joining(","));
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Add a SecurityIdentityAugmentor bean that supplies attributes
2. Verify realm/role mapping in quarkus-elytron-security-reactive configuration
3. Confirm @Authenticated triggers the expected identity augmentation
4. Check HTTP security layer attaches ROUTING_CONTEXT_ATTRIBUTE and other defaults

Example fix

// before: bare identity
// after:
@ApplicationScoped
public class AttrAugmentor implements SecurityIdentityAugmentor {
    // add key/value attributes via QuarkusSecurityIdentity.builder()...
}

Map<String, Object> attrs = identity.getAttributes();
if (attrs == null || attrs.isEmpty()) {
    throw new IllegalStateException("No identity attributes; augmentor not applied");
}

boolean hasAttributes(SecurityIdentity identity) {
    return identity != null && identity.getAttributes() != null && !identity.getAttributes().isEmpty();
}

try {
    renderAttributes(identity.getAttributes());
} catch (RuntimeException e) {
    renderAttributes(Map.of());
}

When it happens

Trigger: GET /attributes with an authenticated identity that has no attributes attached in the reactive security pipeline.

Common situations: No SecurityIdentityAugmentor registered; Elytron realm not mapping roles/attributes; attribute defaults changed between Quarkus versions.

Related errors

• No attributes were specified
• Failed to get user principal
• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• Build step '%s' does not produce any build item and thus wil

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/78e91a2dcd8e1a30. Report an issue: GitHub.