quarkusio/quarkus · error · UnsupportedOperationException

retrieving all roles not supported when JAX-RS security cont

Error message

retrieving all roles not supported when JAX-RS security context has been replaced

What it means

SecurityContextFilter wraps a developer-supplied JAX-RS SecurityContext (one replacing the Quarkus-managed one) in an adapter whose getRoles() cannot enumerate roles, because the replaced context only supports point-wise role checks via isUserInRole. Quarkus throws UnsupportedOperationException to signal that retrieving the full role set is impossible with such a custom context.

Source

Thrown at extensions/resteasy-classic/resteasy/runtime/src/main/java/io/quarkus/resteasy/runtime/SecurityContextFilter.java:65

            return;
        }
        Set<Credential> oldCredentials = old.getCredentials();
        Set<Permission> oldPermissions = old.getPermissions();
        Map<String, Object> oldAttributes = old.getAttributes();
        SecurityIdentity newIdentity = new SecurityIdentity() {
            @Override
            public Principal getPrincipal() {
                return modified.getUserPrincipal();
            }

            @Override
            public boolean isAnonymous() {
                return modified.getUserPrincipal() == null;
            }

            @Override
            public Set<String> getRoles() {
                throw new UnsupportedOperationException(
                        "retrieving all roles not supported when JAX-RS security context has been replaced");
            }

            @Override
            public boolean hasRole(String role) {
                return modified.isUserInRole(role);
            }

            @Override
            public <T extends Credential> T getCredential(Class<T> credentialType) {
                for (Credential cred : getCredentials()) {
                    if (credentialType.isAssignableFrom(cred.getClass())) {
                        return (T) cred;
                    }
                }
                return null;
            }

View on GitHub (pinned to e1c734241f)

Solutions

Do not enumerate roles; call hasRole(role) / isUserInRole(role) for each specific role you need to check.
If you need the full role set, avoid replacing the JAX-RS SecurityContext and instead integrate via Quarkus SecurityIdentity / IdentityProvider so roles are backed by a real identity.
If you must replace the context, wrap a SecurityIdentity that carries the actual roles so the adapter can delegate getRoles() instead of throwing.

Example fix

// before: enumerating roles from a replaced security context
Set<String> roles = securityContext.getRoles();

// after: point-wise check
tenantAllowed = securityContext.isUserInRole("tenant-admin");

Defensive patterns

Strategy: fallback

Validate before calling

boolean canEnumerate = !(securityContext instanceof io.quarkus.resteasy.runtime.SecurityContextFilter.WrappedSecurityContext);
// or simply: prefer hasRole checks
boolean isAdmin = securityContext.isUserInRole("admin");

Type guard

boolean supportsRoleEnumeration(jakarta.ws.rs.core.SecurityContext ctx) {
    // replaced contexts delegate point-wise only
    return ctx.getClass().getName().startsWith("io.quarkus") && !ctx.getClass().getSimpleName().contains("Wrapped");
}

Try / catch

try {
    roles = securityIdentity.getRoles();
} catch (UnsupportedOperationException e) {
    roles = Set.of(); // or derive via candidate role list + hasRole
}

Prevention

Never enumerate roles from a replaced SecurityContext; always use isUserInRole/hasRole.
Integrate custom auth via SecurityIdentity/IdentityProvider instead of swapping SecurityContext.
Document which role-check style your custom context supports.

When it happens

Trigger: Code calls SecurityIdentity.getRoles() (or equivalent role enumeration) on a SecurityContext installed via SecurityContextFilter / a custom @Context SecurityContext replacement in a JAX-RS resource; i.e. any API that requests ALL roles instead of checking a single role via hasRole(role).

Common situations: Developers replace the JAX-RS SecurityContext (e.g. to integrate a custom auth scheme) and then use frameworks or monitoring code that enumerate roles, such as SecurityIdentity.getRoles(), authorization policies that inspect role sets, or debug endpoints that dump the caller's roles.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ab5947fc662f25dd. Report an issue: GitHub.