quarkusio/quarkus · error · IllegalArgumentException

Permission value must not be empty

Error message

Permission value must not be empty

What it means

PermissionToActionUtil.parse() converts a raw config string of the form 'permission-class:action' into a ParsedPermission. It rejects an empty string because no permission class name can be derived from it. This guards the security permission configuration parsing.

Source

Thrown at extensions/security/runtime-spi/src/main/java/io/quarkus/security/spi/runtime/PermissionToActionUtil.java:23

    public sealed interface ParsedPermission {
        String name();

        String action();

        default boolean hasAction() {
            return action() != null;
        }
    }

    record ParsedPermissionImpl(String name, String action) implements ParsedPermission {
    }

    private PermissionToActionUtil() {
    }

    public static ParsedPermission parse(String raw) {
        if (raw.isEmpty()) {
            throw new IllegalArgumentException("Permission value must not be empty");
        }

        var name = new StringBuilder();
        var action = new StringBuilder();
        boolean foundSeparator = false;
        char[] chars = raw.toCharArray();

        for (int i = 0; i < chars.length; i++) {
            switch (chars[i]) {
                case '\\':
                    if (++i == chars.length || chars[i] != ':') {
                        throw new IllegalArgumentException(
                                "Invalid escape sequence in permission value '" + raw
                                        + "': backslash is only allowed before a colon (\\:)");
                    }
                    if (foundSeparator) {
                        action.append(':');
                    } else {

View on GitHub (pinned to e1c734241f)

Solutions

1. Set a non-empty permission value of the form 'com.example.MyPermission:action' (or 'com.example.MyPermission' for no-arg permissions).
2. Remove the empty property entry entirely if the permission is not needed.
3. Check for placeholder expressions (e.g. ${env.VAR}) that resolve to an empty value and provide a default.

Example fix

# before
my-permission=

# after
my-permission=com.example.MyPermission:read

String raw = configValue;
if (raw == null || raw.isEmpty()) {
    throw new IllegalArgumentException("Provide 'PermissionClass[:action]'");
}

try { PermissionToActionUtil.parse(raw); } catch (IllegalArgumentException e) { /* fix empty value */ }

When it happens

Trigger: Configuring a security permission entry whose value is an empty string — a property declared with a key but no value, or a placeholder resolving to ''.

Common situations: An application.properties line like my-permission= with nothing after '='; YAML keys with null/empty values; build-time property placeholders resolving to empty string in security permission configuration.

Related errors

• Invalid escape sequence in permission value '${raw}': backsl
• Permission value '${raw}' contains more than one unescaped c
• Could not obtain credential
• Could not obtain principal
• client-id, client-secret and introspection-url must be confi

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2464e5a3890d41a4. Report an issue: GitHub.