quarkusio/quarkus · error · java.lang.IllegalArgumentException

'%s' must have autodetected params

Error message

'%s' must have autodetected params

What it means

Quarkus builds a StringPermission (name + actions only) at runtime for permissions backed by @PermissionChecker or plain values. StringPermission does not support permission parameters; if a PermissionKey configured with a custom string permission class also declares params (notAutodetectParams), createStringPermission throws this IllegalArgumentException during recording. Custom Permission classes must instead autodetect their constructor parameters.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/PermissionSecurityChecks.java:1085

        }

        private Function<Object[], Permission> createComputedPermission(PermissionCacheKey permissionCacheKey) {
            return recorder.createComputedPermission(permissionCacheKey.permissionKey.name,
                    permissionCacheKey.permissionKey.classSignature(), permissionCacheKey.permissionKey.actions(),
                    permissionCacheKey.passActionsToConstructor, permissionCacheKey.methodParamIndexes(),
                    permissionCacheKey.methodParamConverters, paramConverterGenerator.getConverterNameToMethodHandle());
        }

        private RuntimeValue<Permission> createCustomPermission(PermissionCacheKey permissionCacheKey) {
            return recorder.createPermission(permissionCacheKey.permissionKey.name,
                    permissionCacheKey.permissionKey.classSignature(), permissionCacheKey.permissionKey.actions(),
                    permissionCacheKey.passActionsToConstructor);
        }

        private RuntimeValue<Permission> createStringPermission(PermissionKey permissionKey) {
            if (permissionKey.notAutodetectParams()) {
                // validate - no point to specify params as string permission only accept name and actions
                throw new IllegalArgumentException(String.format("'%s' must have autodetected params", STRING_PERMISSION));
            }
            return recorder.createStringPermission(permissionKey.name, permissionKey.actions());
        }

        private static final class LogicalOrPermissionPredicate {
            private final Set<PermissionWrapper> operands = new LinkedHashSet<>();

            private LogicalOrPermissionPredicate or(PermissionWrapper permission) {
                operands.add(permission);
                return this;
            }

            private List<Function<Object[], Permission>> asComputedPermissions(SecurityCheckRecorder recorder) {
                final List<Function<Object[], Permission>> computedPermissions = new ArrayList<>();
                for (PermissionWrapper wrapper : operands) {
                    if (wrapper.isComputed()) {
                        computedPermissions.add(wrapper.computedPermission);
                    } else {

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the 'params' attribute from this @PermissionsAllowed instance — string permissions accept only name and actions.
2. Use a custom Permission implementation class (clazz attribute) whose constructor accepts the parameters, so params are matched to its constructor instead of the string permission.
3. If you meant to bind method arguments, place the annotation on a method and let Quarkus autodetect params for a permission class that supports them.

Example fix

// before
@PermissionsAllowed(value = "get", params = { "id" }) // StringPermission has no param constructor

// after (custom permission)
@PermissionsAllowed(value = "get", clazz = GetPermission.class, params = { "id" })
// where GetPermission has a constructor GetPermission(String name, Long id)

// String permissions must not declare params:
boolean invalid = clazz == StringPermission.class && params != null && params.length > 0;
if (invalid) throw new IllegalArgumentException("StringPermission cannot accept params; use a custom Permission class");

When it happens

Trigger: A @PermissionsAllowed entry whose Permission class is java.lang.StringPermission (or otherwise resolved to a string permission) while 'params' attribute values are supplied, i.e. explicit parameters on a permission that only accepts name and actions.

Common situations: Adding params to a plain string permission by mistake; copying a custom-permission example but leaving clazz as StringPermission; misunderstanding that params require a custom Permission implementation with a matching constructor.

Related errors

• Cannot transform exception ${exception}
• Unable to determine if bean '${className}' is available
• HTTP Security policy applied only on Quarkus REST cannot be
• @AuthorizationPolicy annotation placed on resource method '$
• Registering default SecurityCheck that requires secured meth

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/154f45f11d099661. Report an issue: GitHub.