quarkusio/quarkus · error · WebSocketServerException

The '%s' CDI bean injection point was detected, but there is

Error message

The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.
Either add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or
implement the provider yourself.

What it means

The application injects WebSocketSecurity (supporting SecurityIdentity updates) but no registered IdentityProvider supports WebSocketIdentityUpdateRequest. The recorder throws this WebSocketServerException at startup, telling you to add an extension (like Quarkus OIDC) or implement a provider that can perform the identity update.

Source

Thrown at extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java:304

        };
    }

    public Function<SyntheticCreationalContext<WebSocketSecurity>, WebSocketSecurity> createWebSocketSecurity() {
        final Supplier<Object> connectionSupplier = connectionSupplier();
        return new Function<SyntheticCreationalContext<WebSocketSecurity>, WebSocketSecurity>() {
            @Override
            public WebSocketSecurity apply(SyntheticCreationalContext<WebSocketSecurity> ctx) {
                Instance<IdentityProvider<?>> identityProviders = ctx.getInjectedReference(new TypeLiteral<>() {
                });
                boolean updateNotSupported = true;
                for (IdentityProvider<?> identityProvider : identityProviders) {
                    if (identityProvider.getRequestType() == WebSocketIdentityUpdateRequest.class) {
                        updateNotSupported = false;
                        break;
                    }
                }
                if (updateNotSupported) {
                    throw new WebSocketServerException("""
                            The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.
                            Either add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or
                            implement the provider yourself.
                            """.formatted(WebSocketSecurity.class.getName(), IdentityProvider.class.getName(),
                            WebSocketIdentityUpdateRequest.class.getName()));
                }
                final IdentityProviderManager identityProviderManager = ctx.getInjectedReference(IdentityProviderManager.class);
                return new WebSocketSecurity() {
                    @Override
                    public CompletionStage<SecurityIdentity> updateSecurityIdentity(String accessToken) {
                        if (connectionSupplier.get() instanceof WebSocketConnectionImpl connection) {
                            SecuritySupport securitySupport = connection.securitySupport();
                            return securitySupport.updateSecurityIdentity(accessToken, connection, identityProviderManager);
                        }
                        throw new WebSocketServerException(
                                "Only SecurityIdentity attached to a WebSocket server connection can be updated");
                    }
                };

View on GitHub (pinned to e1c734241f)

Solutions

Add an extension that supports SecurityIdentity updates (e.g. quarkus-oidc)
Implement an IdentityProvider<WebSocketIdentityUpdateRequest> CDI bean yourself
Remove the WebSocketSecurity identity-update usage if updates are not needed

Example fix

// before
@Inject WebSocketSecurity security; // no provider
// after
@ApplicationScoped
public class WsIdentityUpdateProvider implements IdentityProvider<WebSocketIdentityUpdateRequest> {
    public Class<WebSocketIdentityUpdateRequest> getRequestType() { return WebSocketIdentityUpdateRequest.class; }
    public Uni<SecurityIdentity> authenticate(WebSocketIdentityUpdateRequest request, AuthenticationRequestContext ctx) { ... }
}

Defensive patterns

Strategy: validation

Validate before calling

boolean supported = CDI.current().select(IdentityProvider.class)
    .stream().anyMatch(p -> p.getRequestType() == WebSocketIdentityUpdateRequest.class);

Prevention

Add quarkus-oidc (or implement IdentityProvider<WebSocketIdentityUpdateRequest>) whenever WebSocketSecurity updates are used
Only inject WebSocketSecurity when identity updates are actually needed
Document the provider dependency in the auth module

When it happens

Trigger: Injecting WebSocketSecurity and calling updateSecurityIdentity()/identity update flows while the only registered IdentityProviders handle other request types (e.g. only UsernamePasswordAuthenticationRequest) — so updateNotSupported stays true.

Common situations: Using WebSocketSecurity update APIs with quarkus-security but no OIDC/keycloak extension; switching auth mechanisms so the provider that handled WebSocketIdentityUpdateRequest disappeared; custom IdentityProvider not annotated/registered as a CDI bean.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/a180d2a1171bc0da. Report an issue: GitHub.