quarkusio/quarkus · error · RuntimeException

The '%s' annotation is only supported when proactive authent

Error message

The '%s' annotation is only supported when proactive authentication is disabled

What it means

The @AuthenticationContext (and similar eager security) interceptor only works when proactive authentication is disabled, because it must run at request-time per endpoint. areEagerSecInterceptorsSupported() checks the Vert.x HTTP build-time config and throws RuntimeException if quarkus.http.auth.proactive is true (the default in some versions).

Source

Thrown at extensions/oidc/deployment/src/main/java/io/quarkus/oidc/deployment/OidcBuildStep.java:548

            additionalBeanProducer.produce(AdditionalBeanBuildItem.unremovableOf(WebSocketIdentityUpdateProvider.class));
        }
    }

    @Record(ExecutionTime.STATIC_INIT)
    @BuildStep
    FilterBuildItem registerResourceMetadataHandler(OidcBuildTimeConfig buildTimeConfig,
            BeanContainerBuildItem beanContainerBuildItem, OidcRecorder recorder) {
        if (!isRouteAllowed(buildTimeConfig, OidcRoute.RESOURCE_METADATA)) {
            return null;
        }
        Handler<RoutingContext> handler = recorder.getResourceMetadataHandler(beanContainerBuildItem.getValue());
        return new FilterBuildItem(handler, SecurityHandlerPriorities.AUTHORIZATION - 50);
    }

    private static boolean areEagerSecInterceptorsSupported(Capabilities capabilities,
            VertxHttpBuildTimeConfig httpBuildTimeConfig) {
        if (httpBuildTimeConfig.auth().proactive()) {
            throw new RuntimeException("The '%s' annotation is only supported when proactive authentication is disabled"
                    .formatted(AUTHENTICATION_CONTEXT_NAME));
        } else if (capabilities.isMissing(Capability.WEBSOCKETS_NEXT) && capabilities.isMissing(Capability.RESTEASY_REACTIVE)
                && capabilities.isMissing(Capability.RESTEASY)) {
            throw new RuntimeException("The '%s' can only be used on Jakarta REST or WebSockets Next endpoints");
        }
        return true;
    }

    private static boolean isInjected(BeanRegistrationPhaseBuildItem beanRegistrationPhaseBuildItem, DotName requiredType,
            DotName withoutQualifier) {
        for (InjectionPointInfo injectionPoint : beanRegistrationPhaseBuildItem.getInjectionPoints()) {
            if (requiredType.equals(injectionPoint.getRequiredType().name())
                    && isApplicationPackage(injectionPoint.getTargetInfo())
                    && (withoutQualifier == null || injectionPoint.getRequiredQualifier(withoutQualifier) == null)) {
                LOG.debugf("%s injection point: %s", requiredType.toString(), injectionPoint.getTargetInfo());
                return true;
            }
        }

View on GitHub (pinned to e1c734241f)

Solutions

Set quarkus.http.auth.proactive=false in application.properties
Remove the @AuthenticationContext annotation if proactive auth must stay enabled
Set the acr/max-age requirement globally in OIDC tenant config instead of per-endpoint

Example fix

// before
quarkus.http.auth.proactive=true
// after
quarkus.http.auth.proactive=false

Defensive patterns

Strategy: validation

Validate before calling

// application.properties check before using @AuthenticationContext
// quarkus.http.auth.proactive must be false
if (Boolean.parseBoolean(System.getProperty("quarkus.http.auth.proactive", "true"))) {
    throw new IllegalStateException("Disable proactive auth to use @AuthenticationContext");
}

Try / catch

try { Quarkus.run(args); } catch (RuntimeException e) { if (e.getMessage().contains("only supported when proactive authentication is disabled")) { /* set quarkus.http.auth.proactive=false */ } }

Prevention

Set quarkus.http.auth.proactive=false when using per-endpoint auth annotations
Keep proactive-auth setting and annotation usage consistent
Verify with a build after config changes

When it happens

Trigger: Using @AuthenticationContext on an endpoint while quarkus.http.auth.proactive=true (explicitly set or left at default) — detected during build-step registration.

Common situations: Newer apps relying on default proactive auth that adopt the annotation; upgrading and enabling proactive auth globally while still using per-endpoint acr/max-age annotations.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9bc6c38f012928d7. Report an issue: GitHub.