quarkusio/quarkus · error · RuntimeException

No attributes were specified

Error message

No attributes were specified

What it means

Sentinel RuntimeException thrown by RootResource.getAttributes(). It fires when SecurityIdentity.getAttributes() returns null or an empty map, i.e. the authenticated identity carries no attributes. Quarkus normally attaches at least the routing-context attribute, so an empty map means attribute providers did not contribute anything.

Source

Thrown at integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java:72

    @Authenticated
    public String getSecure() {
        return "secure";
    }

    @GET
    @Path("/user")
    @RolesAllowed("user")
    public String user(@Context SecurityContext sec) {
        return sec.getUserPrincipal().getName() + ":" + identity.getPrincipal().getName() + ":" + principal.getName();
    }

    @GET
    @Path("/attributes")
    @Authenticated
    public String getAttributes() {
        final Map<String, Object> attributes = identity.getAttributes();
        if (attributes == null || attributes.isEmpty()) {
            throw new RuntimeException("No attributes were specified");
        }

        return attributes.entrySet().stream()
                .filter(e -> !HttpSecurityUtils.ROUTING_CONTEXT_ATTRIBUTE.equals(e.getKey()))
                .map(e -> e.getKey() + "=" + e.getValue())
                .collect(Collectors.joining(","));
    }

    @GET
    @Path("/test-security-permission-checker")
    @PermissionsAllowed("see-principal")
    public String getPrincipal(@Context SecurityContext sec) {
        return sec.getUserPrincipal().getName() + ":" + identity.getPrincipal().getName() + ":" + principal.getName();
    }

    @PermissionChecker("see-principal")
    boolean canSeePrincipal(SecurityContext sec) {
        if (sec.getUserPrincipal() == null || sec.getUserPrincipal().getName() == null) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Register a SecurityIdentityAugmentor @ApplicationScoped bean that adds attributes to the identity
2. Verify Elytron realm configuration maps roles/attributes for the authenticated user
3. Check quarkus-elytron-security-* config for attribute-related settings
4. Confirm HttpSecurityUtils.ROUTING_CONTEXT_ATTRIBUTE is being attached by the HTTP security layer

Example fix

// before: no augmentor, identity has no attributes
// after:
@ApplicationScoped
public class AttrAugmentor implements SecurityIdentityAugmentor {
    public Uni<SecurityIdentity> augment(SecurityIdentity identity, SecurityIdentityAugmentationContext ctx) {
        return Uni.createFrom().item(build(identity));
    }
}

Map<String, Object> attrs = securityIdentity.getAttributes();
if (attrs == null || attrs.isEmpty()) {
    throw new IllegalStateException("Identity has no attributes; check SecurityIdentityAugmentor");
}

boolean hasAttributes(SecurityIdentity identity) {
    return identity != null && identity.getAttributes() != null && !identity.getAttributes().isEmpty();
}

try {
    return identity.getAttributes().entrySet();
} catch (RuntimeException e) {
    log.warn("No attributes on identity", e);
    return Set.of();
}

When it happens

Trigger: GET /attributes with an @Authenticated identity whose attribute map is empty — attribute-supplying security providers absent or misconfigured.

Common situations: Custom SecurityIdentityAugmentor removed or not registered; Elytron realm configured without role/attribute mappings; extension version change altering default attributes.

Related errors

• No attributes were specified
• No producers for required item %s, step builder used: %s
• cycle detection failure report (dynamic CycleBuildException
• Build step '%s' does not produce any build item and thus wil
• Cannot consume/produce interface or abstract class build ite

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e71543005618b1dd. Report an issue: GitHub.