What causes "Only user 'bob' is allowed to request roles" in quarkusio/quarkus?

Send a JWT whose subject/name is 'alice' when calling this endpoint

quarkusio/quarkus · error · ForbiddenException

Only user 'bob' is allowed to request roles

Error message

Only user 'bob' is allowed to request roles

What it means

RolesResource.get returns the 'tester' role only for the authenticated user 'alice'; for any other caller (e.g. 'bob') it throws a Jakarta REST ForbiddenException, which Quarkus maps to HTTP 403. Despite the message text, the check actually permits only alice — the message is misleading.

Source

Thrown at integration-tests/smallrye-jwt-token-propagation/src/main/java/io/quarkus/it/keycloak/RolesResource.java:24

import org.eclipse.microprofile.jwt.JsonWebToken;

import io.quarkus.security.Authenticated;
import io.quarkus.security.ForbiddenException;

@Path("/roles")
@Authenticated
public class RolesResource {

    @Inject
    JsonWebToken jwt;

    @GET
    public String get() {
        if ("alice".equals(jwt.getName())) {
            return "tester";
        }
        throw new ForbiddenException("Only user 'bob' is allowed to request roles");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Send a JWT whose subject/name is 'alice' when calling this endpoint
Fix the misleading message or the condition — if 'bob' should be allowed, change the guard to accept bob
Verify your token issuer/claims configuration so the expected principal name is present

Example fix

// before
throw new ForbiddenException("Only user 'bob' is allowed to request roles");
// after
if ("alice".equals(jwt.getName()) || "bob".equals(jwt.getName())) {
    return "tester";
}
throw new ForbiddenException("Only user 'alice' is allowed to request roles");

Defensive patterns

Strategy: try-catch

Validate before calling

// client-side: inspect the token principal before calling
if (!"alice".equals(jwt.getClaim("preferred_username"))) {
    // use a token for 'alice' or expect 403
}

Try / catch

try {
    String role = rolesResource.get();
} catch (ForbiddenException e) {
    // HTTP 403: token principal is not 'alice'; refresh token or switch user
}

Prevention

Check jwt.getName() expectations against your Keycloak token mapper config
Never rely on exception messages for logic — this one names 'bob' but the code checks 'alice'
Write tests per principal (alice, bob, anonymous) to catch guard mismatches

When it happens

Trigger: Calling GET on the roles endpoint while authenticated as any user other than 'alice' (jwt.getName() != 'alice').

Common situations: Testing JWT token propagation with Keycloak where a test token for 'bob' or another principal hits the endpoint; misconfigured Keycloak client mapping that yields the wrong preferred_username.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/12a958cc95d26971. Report an issue: GitHub.